Feature
Organization governance
Roles, service accounts, API tokens, webhooks and an audit log per organization.
An organization owns its canonical packages, workspaces, members and policies. Each member holds one role (org_admin, package_owner, workspace_admin or developer), and a role mapping can derive that role from an external identity provider. Members can be invited, suspended and reactivated.
Service accounts give CI and automation a non-human identity with scoped API tokens. Webhook endpoints receive signed notifications once their ownership is confirmed, and the audit log records who did what to which resource.