Proposal: B2B organizations

SaaS apps need per-customer organizations (members, their own IdP connection, branding, invitations) within a CIAM realm — the Auth0 "Organizations" shape. This elaborates the tenant/realm model (ADR-0012) with a lighter sub-level; it reuses existing seams, so it is a proposal, not a re-architecture.

Motivation

A B2B SaaS serving thousands of customer companies cannot spin up a tenant per customer (too heavy) nor mix them in one undifferentiated user pool. Each customer org needs its own members, federation connection, branding, and invitations — under one realm.

Design

• An organization is a sub-grouping within a realm (ADR-0012): its own members (principals, ADR-0011, via Forseti relations, ADR-0006), connections (which social / enterprise IdP the org federates to, ADR-0019), branding (proposal 0007), and invitation flows (invite → verified-contact accept, proposal 0003).
• A user may belong to multiple organizations; the token carries the active-org context (claim mapping, proposal 0008), so a relying party knows which org the session is for.
• Org-scoped administration is delegated administration (proposal 0016) at org scope.

Alternatives considered

• A realm (or tenant) per customer org — rejected: too heavy to scale to thousands of SaaS customers; orgs are a lightweight construct within a realm.

Graduation criteria

An org has members, a connection, branding, and invitations; a multi-org user receives the correct org context in tokens; an org admin manages only their org.

Backward compatibility

Elaborates the tenant/realm model (ADR-0012) with an organization sub-level expressed as directory + relation constructs; no new architecture.

Open questions

• Active-organization selection UX (an org picker at login); cross-org identity of one user.