GUIDES

Organization-aware access

Build organization-aware application access using session membership, roles, policies, and tenant-bound API routes.

Authorization path

Resolve the user's session and available organizations.
Select an organization only from server-returned membership context.
Evaluate the intended action with the organization and application context.
Call the matching tenant-bound organization route.
Treat policy denials and cross-tenant failures as authoritative; never fall back to client-local membership data.

Permission evaluation

const decision = await fetch("/api/auth/authorization/evaluate", {
  method: "POST",
  credentials: "include",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    organization_id: "org_YOUR_ORGANIZATION_ID",
    action: "members.read",
    resource: "organization"
  })
});