One platform, seven levels of scope
The platform serves multi-brand enterprises through a single hierarchy of organizational scope:
- Consortium → 2. Venture → 3. Brand → 4. Region → 5. Location → 6. Department → 7. Position
Every record, grant, and approval sits somewhere in this tree. The levels let access and reporting be expressed the way the organization already speaks — "regional managers see their region" — without standing up new infrastructure per level.
Where isolation lives
The hard boundary is the brand. Isolation is enforced at the database level: brand context attaches to every query, missing or mismatched context fails closed, and access is deny-by-default until an explicit grant says otherwise. See how per-brand data isolation works for the enforcement model, and database isolation mechanics for the row-level machinery underneath it.
Levels below the brand are scopes, not tenants. A grant that names a region or location narrows what a role can reach inside the brand's boundary; it never creates a new tenant, database, or sign-on. Adding a location is a declaration inside an existing boundary.
Shared versus isolated
- Shared — inherited by every node: Triangle sign-on, approval gates, the audit trail, and automated royalty & fee tracking.
- Isolated — bounded by the brand: operational records such as members, schedules, and transactions, and everything derived from them.
Reading the hierarchy
Hierarchy reads ("everything under this region") match against stored ancestor paths rather than walking the org tree at query time — a closure-table indexing pattern. Paths are written when the tree changes; read cost tracks the size of the answer, not the depth of the tree. This page states design properties only; measured performance belongs to your deployment, not to a public figure.
How this nests in the wider ecosystem
The tenant hierarchy is one axis of the platform's structure. The other is the layer model — who owns the substrate, the platform, and the ventures on top. The two compose: layers decide who builds and publishes; tenancy decides whose data is whose.
Boundary
This is public architectural orientation. Production schemas, tenant provisioning procedures, and environment specifics ship with authenticated developer access.