# 0002 · Single org per deployment

**Status:** Accepted · 2026-09-22

## Context

CoDNA could scope every table by organization and host many companies from one deployment, or treat
one deployment as one company. This decision reaches every query and every permission check, so it
cannot be deferred.

## Decision

One deployment serves one organization. No `org_id` anywhere. A hosted offering would run one
deployment per customer.

## Consequences

- Every permission check is about a user and a document, never a user, a document, and an org.
  The ACL filter in search ([search.md](https://codna.me/docs/search.md)) is already the subtlest code in the system;
  a third dimension would compound it.
- Self-hosting — the common case for an open-source knowledge base — stays simple.
- A cross-org query bug, the characteristic catastrophic failure of multi-tenant systems, is not
  merely unlikely but unexpressible.
- **Retrofitting multi-tenancy means touching essentially every query.** Accepted knowingly.

## Alternatives rejected

**Multi-org from day one.** Correct if a hosted multi-tenant SaaS were the plan. It is not, and the
cost is paid on every line of every query from the first day.

**Row-level security in Postgres.** Elegant for tenant isolation, but it cannot reach Typesense, so
the hardest half of the problem stays unsolved while the illusion of a complete solution is created.