Skip to content

feat: organization-scoped roles and permissions in the access token #416

New issue
New issue
Closed
Feature
#577
Closed
feat: organization-scoped roles and permissions in the access token#416
Feature
#577
Labels
P1Security work outside the FIDO2 tracksecureServes the most-secure promisev0.23Release v0.23: roles, permissions and hooks
Milestone
v0.23

Description

@Bccorb
Bccorb
opened on Oct 13, 2026

Why

Membership roles exist but only org_id reaches the token.

What

  • Roles and permissions for the active organization in the token
  • Typed membership roles instead of free-form strings, with a migration

Done when

A backend can authorize per organization from the token alone.

Activity

  1. Bccorb
    added this to the v0.22 milestone on Oct 13, 2026
  2. Bccorb
    added the
    Feature
    issue type on Oct 13, 2026
  3. Bccorb
    added
    P1Security work outside the FIDO2 track
    secureServes the most-secure promise
    on Oct 13, 2026
  4. Bccorb
    added a parent issue on Oct 13, 2026
  5. Bccorb
    added
    v0.22Targets the v0.22 release
    on Oct 13, 2026
  6. Bccorb
    added
    v0.23Release v0.23: roles, permissions and hooks
    and removed
    v0.22Targets the v0.22 release
    on Nov 2, 2026
  7. Bccorb
    added a commit that references this issue on Nov 6, 2026

    feat(organizations): carry organization roles and permissions in the …

    f7176bb
  8. Bccorb
    closed this as completedin #577on Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P1Security work outside the FIDO2 tracksecureServes the most-secure promisev0.23Release v0.23: roles, permissions and hooks

    Type

    Feature

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions