Organisations and entities

Governax has two levels of tenancy: an organisation, which is your company, and entities inside it, which own connectors and ledgers. Almost everything else follows from that split.

Two levels, on purpose#

A single flat tenant would force one ledger for the whole company. That breaks down quickly. A group with a German subsidiary and a US one needs their records kept apart. A company with a regulated business unit needs that unit's access trail separable from everything else. And an auditor asking about one division should not be handed the whole company's history.

So the ledger is scoped to an entity, not to an organisation. Each entity has its own independent chain that starts at sequence one and proceeds on its own. Two entities never share a chain and never interleave.

What lives where#

The practical consequence: adding someone to your organisation does not by itself give them a ledger to look at, and connecting a tool does not make it visible organisation-wide. Both are entity-scoped decisions.

How this shows up in URLs#

Every in-product URL carries both slugs, organisation first, then entity:

/acme-group/head-office/ledger
/acme-group/head-office/integrations
/acme-group/berlin-gmbh/ledger        <- a different entity, a different chain
/acme-group/settings/members          <- organisation level, no entity

Anything under /{org}/settings is organisation level. Anything with a second slug is entity level.

Choosing your entity boundaries#

The question to ask is: what is the smallest unit someone might one day audit on its own? That is your entity. Common splits:

• By legal entity. The most defensible choice if you operate across jurisdictions, because it matches how regulators think.
• By business unit. Sensible when one unit is regulated and others are not.
• By location. Works when your tooling is genuinely separated by office rather than shared.

Moving a connector between entities means disconnecting it from the first and connecting it to the second. Events already recorded stay where they were written; the ledger is append-only and history does not migrate.

How tenants are kept apart#

Every request that touches entity data resolves the organisation from the URL, confirms you are a member, then resolves the entity and confirms you can reach it. Only after both checks does a query run, and the query is scoped to the ids those checks produced rather than to anything in the request body.

Who can reach which entity is a separate question from what role someone holds, and it catches people out. It is covered in Roles, permissions and entity access.