Skip to content

Feature

Organizations, roles and audit

Every row belongs to one organization, every change is gated by a role and recorded as an audit event.

An organization is the tenant boundary: all business data belongs to exactly one. The API works out which organizations a caller may touch on the server and never trusts an organization id sent by the client.

Org members have one role each: admin, contributor or viewer. Viewers read; changes need a contributor or admin.

Platform staff manage organizations from a separate admin app, read the audit log, mint MCP service tokens and, when supporting a user, act as them only through a time-boxed, revocable impersonation token.