Resource Hierarchy

Ironflow organizes resources in a strict containment hierarchy. Organizations own projects, projects own environments, and environments own every runtime resource — functions and runs, entity streams and projections, topics and webhooks, KV buckets, secrets and config, and API keys. Bootstrap always leaves org_default → proj_default_default → env_default in place; a Platform YAML adds more levels additively on each boot. A sentinel org_platform sits beside the tenant organizations and anchors platform-level resources — the platform roles, and the ifplatform_ keys that manage tenants.

The IRN (Ironflow Resource Name) encodes that chain into a 7-segment identifier. The API key’s resolved scope supplies the org, project and environment segments, and the request path supplies the type and id. The result is the string RBAC policy patterns match, with * standing in for any single segment.