Organisation-based access control

We want to prevent an organisation's mappings being edited by anyone who doesn't have responsibility for the mappings of that organisation. You can edit the mappings for an organisation if:
  * the user is a Transition app "admin" according to Signon
  * the user is a member of the organisation
  * the user is a member of the parent organisation

People with the "admin" permission will include GDS Transition Managers, GDS content editors and others at GDS. Anyone we want to have the power to fix broken mappings.

An alternative to modelling this as a permission would be to say that anyone who is a member of the GDS organisation should have edit rights to any organisation. This would be simpler in terms of maintenance in Signon. There are some disadvantages to it however:
  * Whitehall doesn't currently record GDS as an organisation, so Signon doesn't either. We intend to change that at some unknown point.
  * it feels crude