Organizations

Info

This page is the admin-panel entry point for the Organizations screen. The full conceptual and procedural documentation lives in Organizations. This page covers the GUI surface and what an operator can change there.

In CYPEX, an Organization is the unit of multi-tenancy. It is the data boundary that decides which rows a user can see, insert, update, or delete. Organizations are not an authorization system on their own — they add a per-request data scope on top of the existing PostgreSQL role-based capability model. Both dimensions must agree before a row is returned. See Capabilities vs data scope.

Isolation is enforced by PostgreSQL Row-Level Security, not by UI filtering. The organization filter you see on org-scoped admin screens reflects what the backend already allows — for an Organization Administrator it is not a convenience, it is the boundary.

Access Control → Advanced (System admin) → Organizations.

The sidebar label is Organizations. The page heading is Organizations & Data Scope. The entry sits under the Advanced (System admin) separator but carries admin visibility, so Organization Administrators can reach it for the organizations they are mapped to. Schema Access, directly below it, is system admin only — an Organization Administrator cannot grant their own organization a schema.

• Page actions — Refresh, and (System Administrator only) Create Organization.
• Summary cards — Total Organizations, Active, Inactive, Suspended, Total Users.
• Filters — search (Search organizations…), status, and date range.
• Table columns — Organization, Description, Status, Users, Schemas, Created, Actions. The Schemas cell opens Schema Access for that organization when available.
• Next-step CTA (when at least one organization exists) — Add roles to organization → Go to Roles.

• Organizations list — every organization and its Status (Active / Inactive / Suspended). A System Administrator sees all of them; an Organization Administrator sees only those they are mapped to.
• Create Organization — provisions exactly one primary schema for the new organization in the same transaction. That primary schema determines where the organization’s generated objects land.
• Schema Access — grant additional schemas to an organization with per-schema toggles. System Administrator only.
• Role ↔ Organization mapping — assigned on the role’s Organizations tab under Roles & Capabilities, independently of the role’s Capabilities.
• User ↔ Organization membership — assigned on the user’s Organizations tab under Users.

Warning

An organization with no Schema Access grant sees nothing, regardless of role capabilities or RLS policy — see Schema Access.

Upgrading from v1.9.x creates a Default Organization (organization_domain = 'default') plus a cypex_default virtual module as its primary, maps every pre-existing module to it, and maps every role that is a member of cypex_user or cypex_admin to it. Existing single-tenant data therefore stays visible without a backfill. See Upgrade to v2.0.0.

• Organizations (full docs) — what an organization is, RLS, JWT claims.
• Organizations setup guide — create / edit / disable organizations.
• Schema Access — module/schema grants per organization.
• Access Preview — verify the result before deployment.
• Administration panel — sidebar reference and visibility levels.