Organization Hierarchy & RBAC

PostQode Enterprise provides a multi-tenant structure for managing permissions, LLM proxy budgets, API keys, and collaborative workspace assets across teams.

---

Organizational Structure

Organization (Root Tenant)
├── Sub-Organization A (e.g. Engineering)
│   ├── Team Alpha (Frontend & Extensions)
│   └── Team Beta (Backend & Core Services)
└── Sub-Organization B (e.g. QA & Test Automation)
    └── Team Automation

Hierarchy Definitions

• Organization: The top-level root tenant representing your enterprise entity. Subscriptions, model governance, and root billing apply here.
• Sub-Organization: Logical divisions (such as business units or departments) with isolated budget allocations and team management.
• Team: Operational groups of users collaborating on shared projects, skills, custom agents, and API test suites.

---

Role-Based Access Control (RBAC)

PostQode defines granular roles at both Organization and Team levels.

Organization Roles

Role	Scope	Key Capabilities
Super Admin / Org Admin	Organization-wide	Full control over billing, SCIM, MFA enforcement, Model Governance, API proxy keys, sub-orgs, teams, and user management.
Org Billing Manager	Organization-wide	View billing usage, invoices, update payment methods, and configure budget alerts.
Org Security Admin	Organization-wide	Manage SCIM tokens, audit logs, IP whitelists, and model governance restrictions.
Org Member	Organization-wide	Standard user assigned to teams and sub-organizations.

Team Roles

Role	Key Capabilities
Team Lead / Admin	Add/remove team members, assign team budgets, create shared team rules, custom agents, and API test collections.
Team Developer / Contributor	Execute LLM tasks via Gateway Proxy, run API test suites, create project workflows, and access team skills.
Team Viewer / Auditor	Read-only access to team analytics, test run execution reports, and usage metrics.

---

Managing Members & Invitations

1. Navigate to User Management → Members.
2. Click Invite Users.
3. Enter email addresses, select the target Sub-Organization, Team, and assign appropriate Roles.
4. Invited members receive an email link or SSO redirect to complete registration.