Organization-level Custom Role
A permission management concept in which a custom role belongs to a specific organization rather than to the global environment, enabling tenant-isolated permission control.
Timeline (last 90 days)
Organization-scoped custom roles are a permission management approach that lets a role belong only to a certain organization without affecting other tenants.
Global roles set the scope at the environment layer, with all organizations sharing the same role definition; organization-scoped custom roles push the scope down to the organization layer, making the role a private asset within the organization.
Both the visibility scope and the effective scope of organization-scoped custom roles are confined to the owning organization, and the role lists and existing authorization relationships of other organizations are unaffected.
Organization-scoped custom roles rely on the tenant isolation mechanism in multi-tenant systems: role records carry an organization identifier, and queries and authorizations use the organization as a filter condition.
Under the organization-scoped custom role mechanism, row-level or tenant-level access control policies are usually paired in: platform administrators see an aggregated view, organization administrators see only their own organization's role list, and ordinary users perceive a role only when it is granted.
All Facts (5)
Organization-scoped custom roles are a permission management approach that lets a role belong only to a certain organization without affecting other tenants.
50%UnverifiedGlobal roles set the scope at the environment layer, with all organizations sharing the same role definition; organization-scoped custom roles push the scope down to the organization layer, making the role a private asset within the organization.
50%UnverifiedBoth the visibility scope and the effective scope of organization-scoped custom roles are confined to the owning organization, and the role lists and existing authorization relationships of other organizations are unaffected.
50%UnverifiedOrganization-scoped custom roles rely on the tenant isolation mechanism in multi-tenant systems: role records carry an organization identifier, and queries and authorizations use the organization as a filter condition.
50%UnverifiedUnder the organization-scoped custom role mechanism, row-level or tenant-level access control policies are usually paired in: platform administrators see an aggregated view, organization administrators see only their own organization's role list, and ordinary users perceive a role only when it is granted.
50%