Skip to main content
An org is a self-contained environment: everything you create on Control Plane belongs to exactly one org, and no link, policy, or internal route crosses from one org into another. That makes the org, not the account, the unit that separates staging from production or one subsidiary from another. A single billing account routinely pays for several.
An org name must be globally unique. A name already taken by any org on Control Plane, not only one in your account, is rejected with org named 'my-org' already exists.

​
How It Fits

Everything in an org falls into five groups. Two orgs, staging and production, drawn as two boxes side by side. Each holds the same groups: principals (user, group, serviceaccount), governance (policy, quota, auditctx), infrastructure (cloudaccount, agent, location, ipset, mk8s), assets (secret, image, domain), and compute (gvc), with workload, identity, and volumeset inside each gvc. Staging is a complete environment, from members to workloads; production is the same shape again, sharing none of it. One account can pay for both. You switch orgs on every interface. Only workloads, identities, and volume sets are created inside a GVC; everything else is org-scoped and shared by every GVC in the org. The org’s invoices go to its billing account, whose roles also gate who may create more orgs.

​
Cross-GVC Communication

Workloads in different GVCs within the same org can communicate using internal firewall rules. Access defaults to none, so the receiving workload has to allow it explicitly, with same-org for any workload in the org or workload-list for named ones.

​
Key Behaviors

  • A new org arrives ready to use. Control Plane writes the first access control for you: a superusers group holding the creator, and built-in policies for every resource kind. A working set of built-in locations arrives enabled, and the cpln audit context starts recording every change.
  • Every member can see the org itself. The built-in org policy grants view to every member, so a new user lands somewhere useful before any policy is written for them. Everything beyond that is denied until a policy grants it.
  • Membership is per org. You invite users into each org separately, and the same person holds whatever each org’s policies grant: a superuser in staging can be read-only in production.
  • Org-wide settings are configured once. External logging ships the whole org’s logs to your provider, and log, metric, and trace retention (30 days each by default), threat detection forwarding, the Console session timeout, and SAML-only sign-in all live at the org. Tracing set here is the default every GVC inherits and may override.
  • Quotas are counted per org, not per account. Every GVC, secret, user, domain, agent, and cloud account draws down the org’s own allowance, so splitting environments across orgs also splits the limits. The quota catalog lists the defaults, and an increase request raises one.

​
Gotchas

  • An org cannot be deleted, and its name cannot be changed. The API has no delete operation for orgs, so no interface can delete one. Keep experiments in a disposable GVC rather than a throwaway org.
  • Between orgs there is no internal path at all. Internal firewall values stop at same-org, so two workloads in different orgs reach each other only through public endpoints.
  • Crossing the boundary means authenticating, like any outside client. An image, secret, or domain in one org cannot be referenced from another. Promoting an image from staging to production means the staging org grants pull to a service account, and production stores that account’s key in a pull secret.
  • Billing roles are not org permissions. A billing_admin on the account that pays for the org holds no access inside it; that comes only from the org’s own policies.

​
Learn More

Org reference

Every org setting: logging, tracing, observability retention, threat detection, and permissions.

Create an Org

Start a new environment from the Console or the CLI.

Access Control

The groups and policies every org starts with, and how to grant more.

Billing Account

What pays for your orgs, and the roles that gate creating the next one.