How Departments, Teams, Users, and Permissions Relate

Audience: front-end end users

Relationship diagram

Project (tenant)
 └── Membership (the “user” in User Management)
       ├── can join multiple departments (OrgUnit); one can be the primary department
       ├── can join multiple teams (independent from departments)
       └── can be given a Role
             ├── navigation menu permissions (which sidebar modules they see)
             └── resource action permissions (view / edit / delete on a data type)

Concepts

Concept	UI entry	Description
Department	Department Management	Tree organization; can have a parent department and department admins
Team	Team Management	Flat collaboration unit; can set type (project team / committee / working group) and temporary team
User / member	User Management	Membership in this project; not the global registered-account list
Permission / role	Permission Management	Create roles first, then assign roles to members

Two easy mix-ups

The Department text field on a user card is not the same as the organization department (OrgUnit). For org assignment, use Add to department / Set primary department.
Department admin / Team admin roles usually also need a scope (which departments including children, which teams). Choose the scope when assigning the role, as the UI prompts.

Suggested order

Set up departments (then teams if needed)
Invite friends into the project, or Add user in User Management
In User Management, complete assignment and roles (skip if you already chose department / role when adding)
In Permission Management, maintain reusable role templates