> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.moyoinnovations.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moyoinnovations.com/_mcp/server.

# Core Concepts

> The building blocks of Moyo Suite — organizations, modules, and permissions.

| Concept                   | Description                                                                                                                                                                                                                                           |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Organization (tenant)** | The account boundary. Every lead, invoice, product, and expense belongs to exactly one organization, and organizations never see each other's data.                                                                                                   |
| **Module**                | A product area — CRM, Billing, Inventory, or Expense Management — enabled per organization based on plan. Calling an endpoint or opening a page for a module your organization hasn't enabled returns a `module_not_subscribed` error.                |
| **Permission profile**    | What a team member is allowed to do. Every user has one profile (Owner, Admin, Manager, Member, Viewer, Billing User, or Expense Approver) that governs their access across every enabled module. See [Team & Permissions](/guides/team-permissions). |
| **Permission key**        | The underlying `module:resource:action` triple every permission check resolves to — e.g. `crm:lead:create`, `billing:invoice:export`. You won't usually need these directly; profiles bundle them for you.                                            |
| **Plan**                  | The subscription tier (Free, Starter, Pro, Enterprise) that determines which modules are included and which are paid add-ons. See [Plans & Modules](/guides/plans-modules).                                                                           |

## How a request is authorized

Every action in Moyo Suite is checked in this order:

1. **Are you signed in?** — a valid session (see [Authentication](/getting-started/authentication)).
2. **Which organization are you acting as?** — resolved from your session.
3. **Is the module enabled for this organization?** — e.g. is Expense Management on your plan.
4. **Does your permission profile allow this specific action?** — e.g. can a Member delete a Deal.

A failure at step 3 looks different from a failure at step 4 — the former
means "ask your admin to enable this module," the latter means "ask your
admin to change your permission profile." See [Errors](/getting-started/errors)
for exactly what each response looks like.

## Records and ownership

Within an enabled module, most records (leads, deals, expenses, invoices)
carry an owner. Your permission profile determines whether you see only
records you own, records shared with you, or every record in the
organization — this is what separates, say, a **Member** from a **Manager**.