### Goal Make organization-scoped URL behavior correct and understandable before we onboard real users to Organizations. A URL like `/o/acme/...` starts with the organization path. This epic collects the URL-related work that used to be spread across two places: the tech-debt epic https://gitlab.com/groups/gitlab-org/-/work_items/22433 and direct children of https://gitlab.com/groups/gitlab-org/-/work_items/18055. ### Guiding model We follow the Request Context blueprint: https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/organization/contexts/ (added in https://gitlab.com/gitlab-com/content-sites/handbook/-/merge_requests/20567). GitLab has three request contexts: Organization, User, and Nil. A URL like `/o/acme/...` names, or "anchors", the acme organization. Naming an organization is not the same as putting a data boundary around it. For a non-isolated organization, the request still runs in User or Nil context: the content is scoped to the organization, but not locked down to it. This is similar to how `/gitlab-org/projects` scopes to a group without isolating anything. Only when an organization is isolated does the organization become the real context for the request. ### Launch-critical These two items block onboarding real users, per team discussion in August 2026: - https://gitlab.com/gitlab-org/gitlab/-/work_items/608081 — Navigating into organization-scoped URLs traps the user in the `/o/...` URL space. There is no indicator that this has happened and no clear way out. - https://gitlab.com/gitlab-org/gitlab/-/work_items/605584 — Signing in from an organization-scoped URL fails with a CSRF error. Devise derives an unknown scope, `:organization_user`, from the route name. Two candidate fix merge requests exist, and a decision between them is pending: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/244632 — remove the organization-scoped Devise routes for now. - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/244708 — map the `:organization_user` scope back to `:user`. ### Post-launch The other child items of this epic matter, but they do not block onboarding. One example: https://gitlab.com/gitlab-org/gitlab/-/work_items/595615 — an organization-scoped URL does not check that the group or project in the path actually belongs to the named organization. See the epic tree for the full list. ### DRI @rutgerwessels