> ## Documentation Index
> Fetch the complete documentation index at: https://controlplanecorporation-majid-docs-content-expansion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Org (Organization)
> The top-level isolation boundary, holding every GVC, workload, policy, secret, and user. Membership is granted per org, its policies decide who can do what inside it, and the account that pays for it decides nothing inside it.
An org is a self-contained environment: everything you create on Control Plane belongs to exactly one org, and no link, [policy](/concepts/access-control), or internal route crosses from one org into another. That makes the org, not the account, the unit that separates staging from production or one subsidiary from another. A single [billing account](/concepts/billing) routinely pays for several.
An org name must be globally unique. A name already taken by any org on Control Plane, not only one in your account, is rejected with `org named 'my-org' already exists`.
## How It Fits
Everything in an org falls into five groups.
| Group | What it holds |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Principals | [Users](/reference/user), [groups](/reference/group), and [service accounts](/reference/serviceaccount): the people and automation you grant access to. |
| Governance | [Policies](/concepts/access-control) decide what each principal may do, [quotas](/concepts/quota) cap how much of each resource the org holds, and [audit contexts](/reference/auditctx) hold the trail of changes. |
| Infrastructure | [Cloud accounts](/reference/cloudaccount) connect your cloud providers, [agents](/reference/agent) open a path into your private networks, [locations](/concepts/location) are where workloads run, [IP sets](/reference/ipset) reserve static IPs, and Control Plane operates [Managed Kubernetes clusters](/mk8s/overview) for you. |
| Assets | [Secrets](/reference/secret), [images](/reference/image), and [domains](/reference/domain): what workloads consume and serve traffic on. |
| Compute | [GVCs](/concepts/gvc), each holding its own [workloads](/concepts/workload), [identities](/concepts/identity), and [volume sets](/reference/volumeset). |
Only workloads, identities, and volume sets are created inside a GVC; everything else is org-scoped and shared by every GVC in the org. The org's invoices go to its billing account, whose roles also gate who may create more orgs.
## Cross-GVC Communication
Workloads in different GVCs within the same org can communicate using [internal firewall](/reference/workload/firewall#internal) rules. Access defaults to `none`, so the receiving workload has to allow it explicitly, with `same-org` for any workload in the org or `workload-list` for named ones.
## Key Behaviors
* **A new org arrives ready to use.** Control Plane writes the first access control for you: a `superusers` group holding the creator, and [built-in policies](/reference/policy#built-in-policies) for every resource kind. A working set of built-in locations arrives enabled, and the `cpln` audit context starts recording every change.
* **Every member can see the org itself.** The built-in org policy grants `view` to every member, so a new user lands somewhere useful before any policy is written for them. Everything beyond that is denied until a policy grants it.
* **Membership is per org.** You [invite users](/guides/invite-users) into each org separately, and the same person holds whatever each org's policies grant: a superuser in staging can be read-only in production.
* **Org-wide settings are configured once.** [External logging](/external-logging/overview) ships the whole org's logs to your provider, and log, metric, and trace retention (30 days each by default), [threat detection](/reference/org#threat-detection) forwarding, the Console session timeout, and SAML-only sign-in all live at the org. [Tracing](/reference/org#tracing) set here is the default every GVC inherits and may override.
* **Quotas are counted per org, not per account.** Every GVC, secret, user, domain, agent, and cloud account draws down the org's own allowance, so splitting environments across orgs also splits the limits. The [quota catalog](/guides/manage-quotas#browse-the-quota-catalog) lists the defaults, and an [increase request](/guides/manage-quotas#request-a-quota-increase) raises one.
## Gotchas
* **An org cannot be deleted, and its name cannot be changed.** The API has no delete operation for orgs, so no interface can delete one. Keep experiments in a disposable GVC rather than a throwaway org.
* **Between orgs there is no internal path at all.** Internal firewall values stop at `same-org`, so two workloads in different orgs reach each other only through public endpoints.
* **Crossing the boundary means authenticating, like any outside client.** An image, secret, or domain in one org cannot be referenced from another. Promoting an image from staging to production means the staging org grants `pull` to a service account, and production stores that account's key in a [pull secret](/guides/pull-image).
* **Billing roles are not org permissions.** A `billing_admin` on the account that pays for the org holds no access inside it; that comes only from the org's own policies.
## Learn More
Every org setting: logging, tracing, observability retention, threat detection, and permissions.
Start a new environment from the Console or the CLI.
The groups and policies every org starts with, and how to grant more.
What pays for your orgs, and the roles that gate creating the next one.