> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.kodelabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Provisioning Architecture

> Understand the hierarchical provisioning structure across organizations

Launchpad provisioning follows a three-tier structure, where each tier manages the one below it. Organizations operate strictly within their tier, while trust settings enable controlled access across tiers without requiring separate credentials.

## Provisioning Hierarchy

Provisioning in Launchpad follows a strict top-down hierarchy. Each tier holds authority over the one below it, and access always originates from a higher tier before a lower tier can use it.

```mermaid actions={false} theme={null}
---
config:
  layout: dagre
  theme: neutral
---
flowchart LR
 subgraph s1["Building Portfolio"]
        D1["Building 1"]
        D2["Building 2"]
  end
 subgraph s2["Building Portfolio"]
        D3["Building 1"]
        D4["Building 2"]
  end
 subgraph s3["Building Portfolio"]
        D5["Building 1"]
        D6["Building 2"]
  end
 subgraph s4["Building Portfolio"]
        D7["Building 1"]
        D8["Building 2"]
  end
    A["KODE"] -- Provisioned by KODE --> B1["Channel Partner 2"] & B2["Channel Partner 1"]
    B1 -- Provisioned by CHP --> C1["Client Org B"] & C2["Client Org A"]
    C1 -- Manage --> D1 & D2
    C2 -- Manage --> D3 & D4
    B2 -- Provisioned by CHP --> C3["Client Org B"] & C4["Client Org A"]
    C3 -- Manage --> D5 & D6
    C4 -- Manage --> D7 & D8

    linkStyle 0 stroke:#00C853,fill:none
    linkStyle 1 stroke:#00C853,fill:none
    linkStyle 2 stroke:#00C853,fill:none
    linkStyle 3 stroke:#00C853,fill:none
    linkStyle 4 stroke:#FF6D00,fill:none
    linkStyle 5 stroke:#FF6D00
    linkStyle 6 stroke:#FF6D00,fill:none
    linkStyle 7 stroke:#FF6D00,fill:none
    linkStyle 8 stroke:#00C853,fill:none
    linkStyle 9 stroke:#00C853,fill:none
    linkStyle 10 stroke:#FF6D00,fill:none
    linkStyle 11 stroke:#FF6D00,fill:none
    linkStyle 12 stroke:#FF6D00,fill:none
    linkStyle 13 stroke:#FF6D00,fill:none
```

### Platform Tier

KODE sits at the top of the hierarchy and is the sole entity that provisions channel partners. During this process, KODE grants the channel partner access to Launchpad and enables the KODE OS products they have requested. No other entity can create or modify a channel partner's access.

```mermaid actions={false} theme={null}
---
config:
  layout: dagre
  theme: neutral
---
flowchart TB
    A["KODE"] -- Provisioned by KODE ---> B1["Channel Partner 1"] & B2["Channel Partner 2"] & B3["Channel Partner 3"] & B4["Channel Partner 4"]

    linkStyle 0 stroke:#00C853,fill:none
    linkStyle 1 stroke:#00C853,fill:none
    linkStyle 2 stroke:#00C853,fill:none
    linkStyle 3 stroke:#00C853
```

### Channel Partner Tier

Channel partners provision client organizations and control which KODE OS products each client can access, based on the terms of their agreement. A channel partner can provision any number of clients and manage their entire portfolio of clients directly from Launchpad.

```mermaid actions={false} theme={null}
---
config:
  layout: dagre
  theme: neutral
---
flowchart TB
 subgraph CHP2Clients["Clients"]
        C1["Client Org A"]
        C2["Client Org B"]
  end
 subgraph CHP1Clients["Clients"]
        C3["Client Org A"]
        C4["Client Org B"]
  end
    B1["Channel Partner 2"] -- Provisioned BY CHP2 --> C1 & C2
    B2["Channel Partner 1"] -- Provisioned BY CHP1 --> C3 & C4

    linkStyle 0 stroke:#00C853,fill:none
    linkStyle 1 stroke:#00C853
    linkStyle 2 stroke:#00C853,fill:none
    linkStyle 3 stroke:#00C853,fill:none
```

### Client Organization Tier

Once provisioned by a channel partner, a client organization operates independently within its own Launchpad environment. It adds buildings to its portfolio, manages its users, and creates KODE OS roles, requiring channel partner involvement only for product enablement.

```mermaid actions={false} theme={null}
---
config:
  layout: dagre
  theme: neutral
---
flowchart TB
 subgraph s1["Building Portfolio"]
        D1["Building 1"]
        D2["Building 2"]
  end
 subgraph s2["Building Portfolio"]
        D3["Building 1"]
        D4["Building 2"]
  end
    C1["Client Org B"] -- Manage --> D1 & D2
    C2["Client Org A"] -- Manage --> D3 & D4

    linkStyle 0 stroke:#00C853,fill:none
    linkStyle 1 stroke:#00C853
    linkStyle 2 stroke:#00C853,fill:none
    linkStyle 3 stroke:#00C853,fill:none
```

## Trust Settings

Trust settings allow organizations to invite users from another organization. When one organization trusts another, the trusted organization can invite users. By default, trust is one-way and does not provide reciprocity.

```mermaid actions={false} theme={null}
---
config:
  layout: dagre
  theme: neutral
---
flowchart LR
  subgraph chp["Channel partner"]
    U[Users]
  end
  subgraph clients["Client organizations"]
    C1[Client Org A]
    C2[Client Org B]
  end
  C1 -- One-Way Trust ------- chp
  C2 -- One-Way Trust --------- chp
  C1 -.->|Invite| U
  C2 -.->|Invite| U
  linkStyle 0,1 stroke:#22c55e
```

For more on how users and roles work across organizations, see [Accounts and users](/products/launchpad/get-started/accounts-and-users).