Architectural tiers

Full definitions live in docs/frontend/DOMAIN_MODEL.md. This page is the practical, routing-level version: given a URL or a permission string, which tier does it belong to?

User
 ├── Platform
 └── Organization (Workspace)
      └── Application

User sits above both Platform and Organization, not inside either. You authenticate once as yourself, then reach an Organization you belong to or — if you hold a platform role — Platform administration. Both are reachable from the neutral post-login /dashboard.

Tier	Answers	Routes	Permission prefix	Roles
User	"Who am I, where do I want to work?"	/dashboard, /account/*	—	—
Organization	"What can I do in this organization?"	/org/:slug/*	portal:*, org:*	OWNER/ADMIN/MEMBER/VIEWER (system) + custom roles, per-org
Platform	"What can I manage across the whole system?"	/platform/*	platform:*	SUPER_ADMIN, P4P Owner, P4P Admin, P4P Member (see IAM)
Application	Independent products running inside an Organization	/org/:slug/<app>/*	scoped to the app	inherits Organization membership

A distinction the old design docs get wrong

docs/frontend/INFORMATION_ARCHITECTURE.md describes "Projects"/"CRM"/etc. as generic Applications every organization could subscribe to. That's not what got built. What actually exists under /team/* and /platform/staff is the Internal Company Workspace — P4P's own staffing/PM tool for managing its internal team, departments, projects, and tasks. It's gated by platform:staffing:* permissions and PlatformStaffMembership (you must be an active member of the P4P internal team to see any of it) — a Platform-tier feature, not an Organization-tier Application. See Platform Administration and the forthcoming Staffing module doc.

The genuinely Organization-tier, per-org-subscribed features that exist today are the AI Assistant (org:chat:use, org:agents:manage, org:mcp:manage) and file storage (org:files:*) — both live under /org/:slug/* and are gated per-organization, matching the Application tier as originally designed.

Why this matters when reading the rest of this wiki

Every module doc's frontmatter lists routes and permissions. If a route starts with /platform/ or a permission with platform:, you're looking at Platform-tier behavior — it applies once, platform-wide. If it starts with /org/:slug/ or portal:/org:, it's Organization-tier — the same page behaves differently (or isn't visible at all) depending on which organization you're currently in.