Data model
288 tables today, 514 numbered migrations behind them. Every operator-scoped table carries an operator_scope column and a row-level-isolation policy the database enforces. This page names the shape.
Entity families
| Family | Entities | Purpose |
|---|---|---|
| Identity & access | Operators, workspaces, groups, org-units, delegations, sessions, WebAuthn credentials, Cradle device-keys | The identity plane every other table joins to |
| Departments & Pearls | Departments, Pearl configurations, memory registers, insight rows, playbook selections, prediction traces | The reasoning substrate for each operational domain |
| Operational work | Projects, tasks, decisions, comments, task-department bindings, activity events | The tracker every operator-scoped work item lands in |
| Signals | Signals, acknowledgements, escalations, resolutions | The cross-domain risk plane the Orchestrator maintains |
| Audit chain | Audit events, chain anchors, verification receipts | Every operator-touching mutation elsewhere in the substrate lands one row here |
| Attachments & ingestion | Uploaded documents, meeting recordings, indexed content, embeddings | Row-level isolated from the moment of upload |
| Governance & substrate | ADR nodes, doctrine clusters, ratification events, drift trackers, incident postmortems | The self-describing corpus the platform reasons about itself with |
The row-level-isolation contract
Every operator-scoped table carries a not-null operator_scope column and a database-enforced policy that every SELECT, UPDATE, DELETE, and INSERT filters by. The policy resolves the caller’s identity to a list of scopes at auth time and applies the predicate under the query planner — application code cannot bypass it.
See Row-level isolation for the mechanism and the failure modes.
Discovery & introspection
The full schema is served via:
https://api.nebbos.ai/api/v1/openapi.json— endpoint shapes- Platform admin API — table & column metadata (Architect-tier only)
https://api.nebbos.ai/api/v1/schema/head— current migration head
New tables ship via numbered migrations; the current head is the latest number.
For an operator-scoped export of every row your identity owns, see Portability & export.