Chapter 5: Multi-Tenant Organizations
A user may belong to several customer workspaces with different permissions and authentication policies. Rooiam represents these relationships explicitly rather than placing one workspace role on the user record.
Membership is a relationship
organizations stores workspaces. organization_members joins organization_id to user_id, with a unique pair and membership status. Role assignments live in member_roles, which joins a membership to roles.
The diagram shows why changing one membership's role does not change that user's role in every workspace.
Policy has context
Workspace fields include allow_magic_link, allow_google, allow_microsoft, allow_passkey, require_mfa, and allowed_email_domains. The email-domain list is comma-separated text, not a PostgreSQL array.
get_workspace_policy_for_redirect first looks up an exact registered OAuth redirect URI, then can resolve workspace context from a first-party redirect. Other flows supply an explicit workspace ID. ensure_auth_method_allowed checks the selected method; account/workspace status and other constraints are handled by additional policy and login code.
A missing workspace context does not mean all platform policies disappear. Operator, tenant-portal, and downstream workspace login are distinct surfaces.
Tenant boundaries are explicit checks
A random UUID is not authorization. Handlers and repositories must check membership, permission, and the target record's workspace. SQL does not automatically inject tenant filters into every query, and Rooiam does not claim a universal row-level-security boundary.
For machine integrations, the workspace is derived from the API key. For human sessions, current_org_id supplies context that still requires appropriate authorization checks. A platform user's operator powers and workspace-management rules are handled separately.
Current limits
Workspace governance defaults to five workspaces per user and five apps per workspace. Demo governance uses five workspaces and ten apps per workspace. Platform and per-user settings can affect the effective limits; inspect the governance code instead of treating a UI count as a universal constant.
Exercises
- Draw a user who is owner in one workspace and member in another.
- Trace an API-key member operation and find where its workspace ID originates.
- Find the checks that prevent a tenant from undoing a platform lock.