OrganizationResources (Semantic Module)

← Back to Modules Reference

The OrganizationResources semantic module is applied to associations pointing from the Organization entity to target resource entities (e.g., Project, Invoice, Document).

This links resources to a specific organization, establishing clear multi-tenant boundaries and allowing the runtime to secure data access paths.

---

Technical Specifications

Attribute	Specification
Scope	Association (Applied to relationships between entities)
Data Type	Association / Foreign Key
Has Configuration	No

---

Design Guidelines & Validation Rules

• When to use: Apply to associations defined on the Organization entity that point to resource tables to indicate that the resource belongs to the organization.
• When not to use:
  • Do not apply to the association between the organization and the user entity (use OrganizationMembers instead).
  • Do not confuse with standard Many-to-Many semantic modules (such as ProjectMembers or Tags). The Organization module is specialized to enforce tenant boundaries and handle user membership routing rules.

---

Configuring in the Domain Modeler

To link resources to your organization context in the user interface:

1. Open the Domain Modeler and select your Organization entity.
2. Add a new association (relationship) pointing to the resource entity (e.g. Project).
3. Set the relationship settings:
   • Multiple: Check this option if the organization contains multiple instances of the resource (e.g. projects).
4. In the association details panel, select OrganizationResources under the Semantic Module options.
5. Save your changes.

(UI screenshots of this configuration will be added soon)

---

Runtime Behavior

The Serverless Engine uses this semantic to verify organization boundaries for resources. For endpoints that expose nested resource collections (e.g., /orgs/{orgId}/projects/{projectId} or /orgs/{orgId}/projects/{projectId}/tasks/{taskId}), the runtime ensures the requested resource is linked to the active organization orgId via the association annotated with OrganizationResources before granting access.