#Resource Model

ByteOr Cloud resolves every public control-plane object through the same tenancy hierarchy.

#Resource tree

Organization
└── Project
    └── Environment
        ├── Pipeline Draft
        ├── Pipeline Version
        ├── Config Bundle
        ├── Deployment
        ├── Agent
        ├── Approval
        └── Artifact

#Resource roles

#Organization

The organization is the tenancy boundary.

• members and role assignments
• auth posture and identity-provider integration
• signing keys and organization-scoped API keys
• project ownership under one billing and policy root

#Project

Projects separate product or team ownership.

• environments for one service area
• pipeline drafts and immutable versions
• config bundles and deployment history

#Environment

Environments are the runtime and governance boundary.

• enrolled agents
• deployment approvals and posture
• artifact retention and replay eligibility
• per-environment rollout history

#Draft, Version, Bundle, Deployment

• Draft: mutable authoring state edited in the control plane.
• Version: immutable compiled record created from a saved draft.
• Config bundle: environment-scoped runtime posture attached to a version.
• Deployment: rollout record that binds a version plus bundle to an environment and targets agents.

#Agent, Approval, Artifact

• Agent: enrolled runtime node bound to one environment with one runtime API key.
• Approval: governed-action decision record scoped to the target environment and capability set.
• Artifact: uploaded or generated runtime evidence linked back to agents, deployments, and replay activity.

#Cascade rule

Deleting a parent removes its children. This is why tenancy and project boundaries must be set correctly before drafts, versions, and deployments accumulate under them.

#Related docs

• Workspace and Access
• Deployment States
• Artifacts and Replay