Organizations and confidentiality
Why the tree isn't enough
The data tree says how knowledge is inherited and isolated. What it does not say is which scopes belong to the same company and which do not — and therefore which people are allowed to see one another. Two scopes sitting next to each other in the tree might be two divisions of one company, or two rival clients who must never learn of each other's existence. The tree treats those cases identically; something else has to draw the line.
That something is the organization.
What an organization is
An organization is a boundary you place on a scope. Setting it starts a new organization that covers that scope and everything beneath it — down to, but not including, the next scope that starts its own organization.
An organization bounds one specific thing: which people can see each other (covered in detail under Who can see which users). It does not change data inheritance at all. Keep the two axes apart in your mind:
- Data flows up the tree by inheritance (a scope reads its ancestors).
- People are visible within an organization, and never across its boundary.
New scopes get their own organization by default
Creating a scope defaults to starting its own organization, and asks you to name it. Joining the parent's organization is the deliberate opt-out — an explicit "same organization as the parent" choice.
This default is intentional. The organization boundary protects confidentiality, so the safe choice is the automatic one: a new scope is never quietly absorbed into its parent's people-visibility. You raise a wall by doing nothing; you remove one only on purpose.
How organizations map onto the tree
An organization is a band of the tree, not a single node: it covers the scope you flag and every scope beneath it, until another scope starts its own organization. Two patterns follow — and the boundary, not the tree position, is what tells them apart:
- One organization spanning several scopes. A company keeps its internal divisions in the same organization (the explicit "same organization as the parent" choice). Everyone in the band can find and administer one another.
- Nested scopes that each start their own organization. An agency's clients — or a bank beneath an operator — each begin a new organization. They are nested in the tree but walled off: no one's visibility crosses the boundary, in either direction.
Look at the edges: BankCorp's links to its divisions stay inside one band — same organization — while every link into Atlas and its clients crosses into a different band. The tree connects them all; the bands decide who can see whom.
What this means in practice
- Within one organization, people can find and administer each other — colleagues across data-isolated internal scopes can still collaborate. (This is flat by default; a scope can tighten it, see Who can see which users.)
- Across organizations, people are mutually invisible in both directions — even when one organization is nested inside another's subtree. A bank under an operator cannot see the operator's people, and the operator cannot see the bank's.
- An agency that fully manages its clients might keep those clients in its own organization, so its staff can administer them directly.
- An agency whose clients must stay confidential from one another leaves each client as its own organization — the default — so no client's people are ever visible to another.
The choice is yours, per scope, and it is the single most important confidentiality decision you make when structuring a deployment.
Changing the boundary later
The organization boundary is normally set when a scope is created. It can be changed afterwards, but the two directions are not equally casual:
- Raising a new boundary (splitting a scope into its own organization) only narrows visibility — people on either side stop seeing each other. It affects your own scope and its parent, no one else.
- Removing a boundary (merging a scope into its parent's organization) widens visibility — it makes the parent organization's whole population and the scope's population mutually visible. Because it exposes two parties, it is treated as a significant, jointly-authorized change, not routine administration.
Both changes are recorded in the audit trail with extra detail. The step-by-step procedures live in the administration guides; for now, the concept to carry forward is: the organization is the hard wall around who can see whom, and it defaults to closed.