Domain model

The map, by permission area

The product at a glance: four permission areas around a single axis — an event produces detections over your portfolio's AOIs, a detection can open an adjustment inside a claim, and the adjustment ends in a signed report verifiable offline. Each area carries the canonical-catalog permissions that govern its endpoints.

The exhaustive reference

The full detail, entity by entity and with its cardinalities:

erDiagram
    ORGANIZATION ||--o{ PORTFOLIO : "tiene"
    ORGANIZATION ||--o{ CLIENT : "tiene"
    ORGANIZATION ||--|| ORG_BRANDING : "se ve como"
    PORTFOLIO ||--o{ AOI : "agrupa"
    CLIENT ||--o{ POLICY : "contrata"
    POLICY }o--o{ AOI : "cubre"
    EVENT ||--o{ DETECTION : "produce"
    AOI ||--o{ DETECTION : "sobre"
    AOI ||--o{ CLAIM : "sobre"
    CLAIM ||--o{ PERITAJE : "se perita en"
    DETECTION ||--o{ PERITAJE : "mide"
    CLAIM ||--o{ REPORT : "se reporta en"
    REPORT ||--o| SIGNATURE : "firmado con"
    AOI ||--o{ WATCH_SUBSCRIPTION : "vigilado por"
    WATCH_SUBSCRIPTION ||--o{ ALERT : "emite"
    ALERT ||--o{ WEBHOOK_DELIVERY : "notifica por"

The four rules the model enforces

Everything hangs off an organization. There is no entity without a tenant. That is what lets a resource from another organization answer 404 instead of 403: the runtime always knows whose thing is being requested.

An adjustment needs a detection. It is not an optional relation: an adjustment without a measurement is not evidence, it is an opinion with formatting. The contract validates it.

An approved report needs a signature. Approved without a signature is not verifiable evidence, and publishing it as if it were is worse than having no signature.

An AOI has a geometry version. Redrawing the plot is a different computation: aoiVersion goes into the content hash of /v1/jobs so an old footprint is not reused with a new geometry.

What governs each area

Each entity is read and written with the permission of its area of the canonical catalog (ADR 0006), not with a global one:

The copilot and the search re-check the area permission before reading. A single gate would be enough for someone with portfolio permission to read claims through a side window, leaving no trace on any screen.