> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Org Units

> Flexible, hierarchical groupings that control room access and data-sharing scope in Enclave.

## What are Org Units?

Org Units are the membership layer between your organisation and its rooms. A user must belong to an Org Unit to be added to any room that Org Unit owns.

They mirror your real-world structure — teams, departments, domains, subsidiaries, or any grouping that makes sense for your organisation.

## Creating an Org Unit

1. Navigate to **Organisation → Structure**
2. Click **New Org Unit**
3. Enter a **name** and a **type label** (see below)
4. Optionally add a description and select a parent Org Unit
5. Click **Create**

## Type label

Every Org Unit requires a **type label** — a free-text string that describes what kind of group it is. Common labels include:

| Label      | Typical use                                              |
| ---------- | -------------------------------------------------------- |
| Domain     | Broad functional area (e.g. Legal, Finance, Engineering) |
| Department | Formal business department                               |
| Team       | Sub-group within a department or domain                  |
| Squad      | Agile team or delivery unit                              |
| Division   | Business unit or regional subsidiary                     |
| Project    | Temporary group for a specific engagement                |
| Unit       | Generic structural unit                                  |
| Group      | Informal grouping                                        |

You are not limited to this list — any label that suits your structure is valid. The label is chosen when you create the Org Unit and can be updated afterwards.

<Note>
  Type labels are **display-only**. They do not affect permissions, access control, or hierarchy. Access is determined entirely by hierarchy (parent/child relationships) and explicit memberships.
</Note>

Type labels are used by:

* **Org Unit Roster** — for filtering and at-a-glance identification
* **Per-type sharing policies** — security officers can restrict sharing to specific type labels (e.g. block sharing to all "Domain" units at C3 classification). See [Data Sharing Policies](/enclave/sharing-policies#per-org-unit-type-rules).

## Nested Org Units (hierarchy)

Org Units can be nested to any depth. Select a **parent** when creating an Org Unit to place it in the hierarchy.

```
Engineering (Domain)
├── Backend (Team)
│   └── Platform (Squad)
└── Frontend (Team)
```

Hierarchy rules:

* Sharing to a parent Org Unit propagates **downward** — users in child units also receive access
* Sharing to a child Org Unit does **not** propagate upward — parent unit members are not included
* Admin scope follows the same pattern: an Org Admin managing "Engineering" can manage all nested units

## Adding members

1. Open the Org Unit
2. Click **Add member**
3. Search for a user by name or email
4. Select their role within the Org Unit
5. Click **Add**

<Note>
  Users can be members of **multiple** Org Units. Each membership is explicit — there is no implicit inheritance from parent units or admin roles.
</Note>

Org Unit member roles:

| Role        | Permissions within the Org Unit         |
| ----------- | --------------------------------------- |
| manager     | Can add/remove members and manage rooms |
| contributor | Can upload files to rooms               |
| viewer      | Read-only access to rooms               |

## Removing members

Removing a user from an Org Unit removes their access to all rooms owned by that Org Unit immediately. Active sessions are terminated.

Use **Organisation → Policies → Org Unit Roster** to audit all user–Org Unit relationships before making changes.

## Access reviews

Org Unit memberships can be periodically reviewed to certify that each user still needs access. See [Access Control → Access Reviews](/enclave/access-control#access-reviews).