Skip to content

6.2.2.6 OrganizationDelegationMembership

6.2.2.6.1 Purpose

Lets one Organization act on behalf of another with a given role, for example a cooperative managing the data of one of its farms, or an insurer reading the herds it covers. The delegator is always a farm and the delegatee never is: a cooperative, an insurer or a professional. The delegator chooses the role; members of the delegatee then receive delegated memberships limited to that role.

Who a person acts as stays separate from the farm they work on. A person acts as the delegatee, their own Organization, and picks a farm that delegated to it as the subject of their work; delegated rights count only while they act as the delegatee, never mixed with the rights they hold in a farm of their own.

6.2.2.6.2 Questions it answers

  • Which Organizations can act for this one, and with which role?
  • Which types of Organization can receive a delegation, and which roles?
  • How does a farm name the Organization it shares with, when there is no directory of Organizations?
  • Who gave the delegation, and when?
  • Which capabilities can never be delegated?
  • Which members of the delegatee can create delegated memberships?

6.2.2.6.3 Fields

Field Type Cardinality Description
id string (uuid) 1..1 Key.
delegatee Organization 1..1 Organization that can act on behalf of the delegator Organization.
A Cooperative, an Insurer or a Professional, never a Farm, and the role must be one its type receives (OrganizationRoleAccessControl.delegatee_types).
role OrganizationRoleAccessControl 1..1 Must hold no admin capability (OrganizationRoleCapabilityEnum) and be neither Owner nor Sync Client. So a delegation cannot be delegated further, and a delegatee cannot change who is in the delegator, its profile, its constraints, its sources or where its data goes, nor move its animals away. Technician, Veterinarian and Advisor (OrganizationPredefinedRoleEnum) can be delegated, and Analyst to an Insurer only; Advisor is the usual role for a cooperative.
The delegator changes the role of an active delegation in one step, under the same rules as giving it: the delegation keeps its id, its DelegatedMemberships and DelegatedGroupRoles take the new role, and the previous image stays in the history (SystemVersion). It is never a revoke and a new delegation.
delegator Organization 1..1 Organization that delegates some role to the delegatee Organization.
Must be different from the delegatee.
A Farm: a delegation shares farm data.
(delegator, delegatee, role) unique among active delegations.
created_by User 1..1 Who gave the delegation, with access.organization_delegations.manage in the delegator, so both Organizations can read "Shared by Giovanni Ronchi on 3 November".
revoked_at datetime 0..1 When the delegation ended; rows are never deleted.
revoked_by User 0..1
system_version SystemVersion 1..1
created_at datetime 1..1
updated_at datetime 1..1

6.2.2.6.4 Relationships

References

Referenced by

Uses types

SystemVersion

6.2.2.6.5 Rules & constraints

  • Either side can end a delegation: the delegator revokes it, the delegatee renounces it; both need access.organization_delegations.manage in their own Organization, and creating or revoking one follows the priority rule (OrganizationRoleAccessControl.priority). Ending it revokes its DelegatedMemberships and DelegatedGroupRoles.
  • Once the delegatee get the role to operate on behalf of the delegator, the members who can create DelegatedMembership are limited to the roles that the delegatee has been granted by the delegator.
  • There is no directory or search of Organizations. A farm shares with its own Farm.cooperative directly; any other delegatee, such as an insurer, a veterinary practice or an advisor, is named by a share code it created, which the delegator types in. No other delegatee can be named.
  • A share code is a short code an Organization creates in its own Organization Dashboard and gives to a farm, which types it in its share dialog, sees whose it is, chooses the role and confirms. The code names the delegatee and gives nothing by itself: the delegator alone chooses the OrganizationDelegationMembership.role. Like an authorization code it is internal state of access, not an entity.
  • Creating a share code needs access.organization_delegations.manage in the Organization it names, which must be active and a Cooperative, an Insurer or a Professional, since a Farm never receives a delegation.
  • A share code is eight characters of Crockford Base32 (no I, L, O or U), shown once as two groups of four such as K7QM-4XPD, and read without case, spaces or hyphens. access keeps a keyed hash of it (HMAC-SHA-256 with a key of access), since a short code could be found again from a plain hash, with its Organization, its creator and its expiry.
  • A share code lasts seven days and works once: the delegation made with it uses it up. Its creator's Organization can revoke it before; a used, revoked or expired code is deleted, and the audit records which code made which delegation.
  • Resolving a share code needs access.organization_delegations.manage in the delegator and answers the name, type and status of its Organization. An unknown, used, revoked or expired code gets the same answer, not found, and ten wrong codes in an hour stop the delegator from trying for that hour, so codes cannot be guessed. A code never names the delegator itself.
  • Each side reads the other Organization's name, type and status with the delegation, without being its member, and the name of the Person who created it (OrganizationDelegationMembership.created_by), never their contacts.
  • Who a person acts as is separate from the farm they work on: they act as one of their own Organizations, the token's active Organization (RefreshToken.organization). Acting as a delegatee, an app lists the farms that delegated to it, with the delegated role, and the person picks one as the subject of their work; the token stays the delegatee's. The audit records both (PlatformAuditEvent.organization, PlatformAuditEvent.acting_organization).