starter.wiki中文

Identity

B2B Organizations & Multi-Tenancy

Choose how tenant identity, memberships, invitations, and roles relate to the product's own organization domain.

Recommendation

Use identity organization primitives without outsourcing the product's tenant domain.

Provider organization records do not by themselves define billing, entitlements, resource authorization, data isolation, or business workflows.237

For: B2B SaaS teams designing organizations, workspaces, and tenant membership

Main trade-off

Delegating membership primitives couples organization identifiers and lifecycle rules to the provider model.123

Organization ownership models

Separate identity membership from the broader product and data-isolation model.

  1. Tenant boundary

    Define the unit that owns data, billing, contracts, entitlements, and identity connections.37

  2. Membership complexity

    Estimate roles, teams, invitations, cross-tenant users, and delegated administration.12

  3. Isolation model

    Keep database and authorization isolation explicit; an organization ID alone is not isolation.7

  4. Enterprise lifecycle

    Determine whether federation and directory provisioning must attach to each tenant.3456

Organization routes

Select the identity layer while keeping product-domain boundaries explicit.

Application-owned tenant domain

Use Better Auth organization primitives or an application-owned model.

This fits teams that need infrastructure ownership and close alignment with product-specific tenancy.

Verify: The team owns invitation security, membership integrity, and administration UX.1

Managed organization primitives

Use Clerk Organizations.

Managed memberships, invitations, roles, and active organization context accelerate common B2B identity flows.

Verify: Keep billing, entitlements, authorization policy, and data isolation in application systems.27

Enterprise B2B identity

Use WorkOS, Frontegg, or Stytch when federation, directory lifecycle, customer administration, or organization-first authentication drives the design.

Enterprise identity integrations and B2B-primary authentication benefit from organization-centered connection and lifecycle models.

Verify: Validate whether provider tenant concepts match the product's contractual tenant boundary.3456

Boundary: Organization identity primitives are not a complete multi-tenancy architecture and do not replace authorization or data isolation.

What actually differs

The core question is how much of tenant identity belongs in the provider.

Identity membership
Providers can manage users joining organizations and selecting active context.12
Product tenancy
Billing, entitlements, resource ownership, and workflow state remain domain concerns.37
Isolation
Database and authorization enforcement must not rely only on client-selected organization context.7
Enterprise mapping
SSO connections and directory groups need an explicit mapping to the application's tenant.345

Official resources

Use provider documentation to validate membership primitives and keep the product tenancy boundary explicit.

DocumentationClerk Organizations

Sources

Primary sources supporting the organization routes and boundary.

  1. 1
    Better Auth organization plugin

    Better Auth · Accessed Official

  2. 2
    Clerk Organizations

    Clerk · Accessed Official

  3. 3
    WorkOS users and organizations

    WorkOS · Accessed Official

  4. 4
    Frontegg tenants API

    Frontegg · Accessed Official

  5. 5
    Stytch B2B Organizations

    Stytch · Accessed Official

  6. 6
    Stytch SCIM overview

    Stytch · Accessed Official

  7. 7
    Clerk multi-tenant architecture

    Clerk · Accessed Official