docs: define organization account model

docs/product/glossary.md

@@ -2,28 +2,67 @@
 
 Use these terms consistently in product docs, specs, UI copy, and code discussions.
 
-## Workspace
+## Organization
 
-Top-level working container for a client account.
+SaaS account boundary that owns billing, subscription, limits, organization-level users, connectors, data mappings, and workspaces.
 
-An agency may manage multiple workspaces.
+An organization may be an agency, an in-house brand company, or a professional's business account.
 
 Use:
 
-- ownership boundary
-- membership boundary
-- scoping boundary for content items, assets, comments, approvals, and notifications
+- billing and subscription boundary
+- ownership boundary for workspaces
+- connector and integration configuration boundary
+- organization-level membership and permission boundary
 
 Do not use as:
 
+- synonym for a brand workspace
+- synonym for a single human user account
+- synonym for an external reviewer
+
+## Workspace
+
+Brand, client, or operating workspace where content workflow happens.
+
+Each workspace belongs to exactly one organization and is not shared between organizations.
+
+Use:
+
+- brand/client workflow boundary
+- scoping boundary for content items, assets, comments, approvals, and notifications
+- channel configuration boundary
+
+Do not use as:
+
+- top-level SaaS account boundary
+- billing or subscription boundary
 - synonym for internal role
 - synonym for team member role
 
+## Organization Member
+
+User access relationship at the organization level.
+
+Organization membership can grant organization-level permissions and inherited access to all workspaces owned by that organization.
+
+## Workspace Member
+
+User access relationship at the workspace level.
+
+Workspace membership grants direct access to one workspace and can classify the user's relationship to the owning organization as `Organization Member` or `External Collaborator`.
+
+An `Organization Member` is part of the organization that owns the workspace. They may have access through organization membership, direct workspace membership, or both.
+
+An `External Collaborator` is not part of the owning organization but has direct workspace access. This includes subcontractors, providers, clients, and external reviewers.
+
+Workspace membership can override applicable inherited workspace permissions.
+
 ## Agency
 
-Operating organization managing one or more workspaces.
+Type of organization that manages one or more brand/client workspaces for customers.
 
-An agency is above the workspace level in the business model.
+Use `Organization` for the product model unless specifically describing an agency customer.
 
 ## Client
 
@@ -106,6 +145,8 @@ Examples:
 
 Specific destination, account, handle, page, or feed within a network.
 
+Channels are configured inside a workspace. The connector or integration credentials used to access external systems are owned by the organization.
+
 Examples:
 
 - `@MyBrand` on Instagram