---
title: "Give roles inside an organisation · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/roles-and-permissions/org-scoped-roles
updated: 2026-10-20
licence: "All rights reserved"
---

# Give roles inside an organisation

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions)
- Rule: Store customer roles on the membership between a user and an organisation. Keep staff roles in a separate store that customer code cannot write.
- How: One person can own one organisation and be a viewer in another, which a `role` column on the user cannot say. Store user, organisation and role, unique on the pair. Read the role for the organisation named in the request's address, never the one the user saw last. Staff roles live apart, as [use separate staff accounts](https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts) says.
- Check: Make a test user owner of organisation A and viewer in B. An owner action in B answers 403, and the same action in A succeeds.

Example:

```sql
CREATE TABLE memberships (
  user_id uuid NOT NULL REFERENCES users (id) ON DELETE CASCADE,
  organisation_id uuid NOT NULL REFERENCES organisations (id) ON DELETE CASCADE,
  role text NOT NULL CHECK (role IN ('owner', 'admin', 'member', 'viewer')),
  PRIMARY KEY (organisation_id, user_id)
);
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/roles-and-permissions/org-scoped-roles`.

- Previous: [Test every role against every action](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permission-matrix-test)
- Next: [Make role changes count on the next request](https://agentwranglers.se/playbook/accounts/roles-and-permissions/role-changes-immediate)
- [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions)