Boundaries between applications

An application sees only the organisations that use it.
An application has no knowledge of the other applications an organisation uses.
An application can be granted read-only access: every change is refused.