Organization Workspaces with Role-Based Access Control and Data Segmentation

Summary

Introduce organization workspaces so teams can manage users, permissions, and scoped data (articles, saved filters, subscriptions, comments, and newsletter settings) under a shared tenant boundary.

Problem

The platform has user authentication, but no organization-level separation for multi-team deployments. Government programs and departments need strict data boundaries, shared team workflows, and role-based permissions beyond single-user ownership.

Proposed Solution

• Add first-class Organization and Membership models.
• Implement workspace-level RBAC roles (for example: owner, admin, editor, viewer).
• Scope data queries and writes by organizationId.
• Add workspace switcher UI and org admin settings page.
• Enforce role checks on sensitive actions (source policy edits, review approvals, newsletter config, etc.).
• Add invitation flow for adding users to an organization.

Acceptance Criteria

• Users can create an organization and invite members by email.
• Membership roles can be assigned and changed by authorized users.
• All relevant records include organizationId and are inaccessible across organizations.
• API authorization denies actions outside member permissions.
• Frontend shows active workspace context and supports switching between workspaces.
• Existing single-tenant data is migrated to a default organization without data loss.

Technical Notes

• Backend:
  • New collections: organizations, memberships, invitations.
  • Middleware to inject/validate active organizationId for API requests.
  • RBAC policy map for route-level authorization.
• Frontend:
  • Workspace switcher in app header.
  • Organization admin screens for members, invites, and role management.
• Security:
  • Signed invite tokens with expiration.
  • Audit events for membership and role changes.

Tasks

• Design schemas and indexes for organization/membership/invitation.
• Add migration path from user-owned data to organization-scoped data.
• Implement invite acceptance and role assignment APIs.
• Apply organization scoping middleware to article/filter/subscription/review/newsletter endpoints.
• Implement RBAC checks for privileged operations.
• Build workspace switcher and org management UI.
• Add unit/integration tests for cross-organization isolation and permission checks.
• Update API docs and onboarding docs for workspace administration.

Out of Scope (Initial Iteration)

• External SSO/SCIM provisioning.
• Cross-organization data sharing or federation.