---
path: /studio/yemaya/organization-management
surface: studio
domain: yemaya
auth: signed-in + studio entitlement
source: apps/oshun/web/src/app/studio/yemaya/organization-management/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Studio · Yemaya · Organization Management

## Purpose

Admin lane console wired to the `@yemaya/rbac` shipped role hierarchy: pick a
scope (system / organization / project / team) and a built-in role to resolve
its effective permissions (with inheritance), or check whether a single
capability is granted to that role.

## Entry points

- Studio index quick-actions.
- No breadcrumb panel on this page.
- This page links out to `/studio/yemaya/developer-sdks`.
- Embedded as a lane inside `/studio/yemaya/enterprise`.
- Direct URL / bookmark (signed-in + studio entitlement).

## Layout regions

`page.tsx` renders `ShellLayout active="studio"` and:

- **Workspace panel** (`StudioYemayaOrganizationManagementWorkspace`,
  `data-yemaya-organization-management-workspace`):
  - `<h1>` "Yemaya Organization Management Workspace".
  - Summary `<p data-yemaya-organization-management-summary>` (resolve the shipped
    role hierarchy to effective permissions).
  - **Role Hierarchy Operations Lane** — `<h2 data-yemaya-om-lane-heading>` with
    loading / unauthorized / error / ready-form / result; scope + role selects, a
    resolve form, and a check form.
- **Route Map panel** (`data-yemaya-organization-management-route-map`): `<h2>`
  "Route Map" with five entries.
- **Quick-action panel**: two `quickAction` links.

## States

- [ ] **Loading** — `data-yemaya-om-loading` ("Loading RBAC engine…").
- [ ] **Unauthorized** — 401/403 → `data-yemaya-om-unauthorized` with reason
      "Yemaya workspace scope required to inspect the role hierarchy.".
- [ ] **Error** — non-OK / malformed catalog → `data-yemaya-om-error`.
- [ ] **Ready-form** — catalog (`summary`, `scopes[]`) loaded; the scope `<select>`
      drives the role `<select>` options.
- [ ] **Resolve result** — 200 → `data-yemaya-om-resolve-result` with
      `data-yemaya-om-resolve-headline` and `data-yemaya-om-permissions` (each
      `data-yemaya-om-permission-row`); failure → `data-yemaya-om-resolve-error`.
- [ ] **Check result** — 200 → `data-yemaya-om-check-result` with
      `data-yemaya-om-check-verdict` (granted/denied); empty permission or failure
      → `data-yemaya-om-check-error`.

## Interactions

### Role Hierarchy Operations Lane

- [ ] **Scope** — `<select data-yemaya-om-scope>` from `catalog.scopes`; selecting
      a scope resets the role to that scope's first role.
- [ ] **Role** — `<select data-yemaya-om-role>` from the selected scope's roles.

Resolve form (`<form data-yemaya-om-resolve-form>`):

- [ ] **"Resolve effective permissions"** submit
      (`data-yemaya-om-resolve-submit`) — POSTs `{ scope, role }` to the resolve
      endpoint.

Check form (`<form data-yemaya-om-check-form>`):

- [ ] **Permission to check** — `<input data-yemaya-om-permission>` (aria-label
      "permission", e.g. `asset:delete`).
- [ ] **"Check capability"** submit (`data-yemaya-om-check-submit`) — POSTs `{
      scope, role, permission }` to the check endpoint.

### Route map

`data-yemaya-organization-management-route-map` — five entries:

- [ ] `/studio/yemaya/organization-management`
- [ ] `/studio/yemaya/organization-management/scenes/[sceneId]`
- [ ] `/studio/yemaya/organization-management/exports/[exportId]`
- [ ] `/studio/yemaya/organization-management/revisions/[revisionId]`
- [ ] `/studio/yemaya/organization-management/governance/[policyId]`

### Quick actions

- [ ] **"Open Yemaya Developer SDKs workspace"** →
      `/studio/yemaya/developer-sdks`.
- [ ] **"Back to Studio workspace index"** → `/studio`.

## Data & contracts

- **Reads**: `GET /v1/admin/yemaya/organization-management` (catalog; `summary`,
  `scopes[]` with per-scope roles) on mount with `buildBffAuthHeaders()`, `cache:
  'no-store'`.
- **Writes**:
  - `POST /v1/admin/yemaya/organization-management/resolve` → `{ result: { scope,
    role, description, inherits, permissions[], permissionCount } }`.
  - `POST /v1/admin/yemaya/organization-management/check` → `{ result: { scope,
    role, permission, granted } }`.
- **Realtime**: None.
- **Caching**: client `fetch` on mount, no-store; aborted on unmount.
- **Auth/role check**: admin-scoped, fail-closed; route additionally signed-in +
  studio via the proxy gate.

## Cross-references

- Workspace source:
  `apps/oshun/web/src/components/studio/StudioYemayaOrganizationManagementWorkspace.tsx`
- Route map source:
  `apps/oshun/web/src/components/studio/StudioYemayaOrganizationManagementRouteMap.ts`
- Page source:
  `apps/oshun/web/src/app/studio/yemaya/organization-management/page.tsx`
- Embedded in: [`studio-yemaya-enterprise.md`](./studio-yemaya-enterprise.md)
- Studio overview: [`studio-overview.md`](../../studio-overview.md)
- Feature spec: [`V1/features.md`](../../../../V1/features.md)

## Open questions / known gaps

- [ ] The lane resolves/inspects the shipped role hierarchy but cannot mutate it
      (no create/edit role path); confirm whether role authoring is planned for
      this route.
- [ ] Route-map children (`scenes`/`exports`/`revisions`/`governance`) are a
      sitemap contract; confirm which dynamic pages exist.