starter.wiki搜索⌘KEN

任务决策

B2B 组织与多租户：先定义数据隔离，再选组织功能

处理工作区、成员、邀请、角色和租户边界，而不把它们简化成一个组织表。

Recommendation

让业务数据隔离规则留在应用中；身份平台提供成员与组织上下文即可。

先确定隔离级别、成员模型和企业管理责任，再决定身份服务承担多少组织能力。237

适用范围： B2B SaaS teams designing organizations, workspaces, and tenant membership

Main trade-off

预置组织功能能快上线，但复杂 B2B 权限最终仍需产品自有模型。123

选择标准

按真实约束逐项判断，不要只比较功能列表。

  1. Tenant boundary

    Define the unit that owns data, billing, contracts, entitlements, and identity connections.37

  2. Membership complexity

    Estimate roles, teams, invitations, cross-tenant users, and delegated administration.12

  3. Isolation model

    Keep database and authorization isolation explicit; an organization ID alone is not isolation.7

  4. Enterprise lifecycle

    Determine whether federation and directory provisioning must attach to each tenant.3456

适用路线

这些条件会改变默认答案；请在作出承诺前逐项验证。

Application-owned tenant domain

Use Better Auth organization primitives or an application-owned model.

This fits teams that need infrastructure ownership and close alignment with product-specific tenancy.

Verify: The team owns invitation security, membership integrity, and administration UX.1

Managed organization primitives

Use Clerk Organizations.

Managed memberships, invitations, roles, and active organization context accelerate common B2B identity flows.

Verify: Keep billing, entitlements, authorization policy, and data isolation in application systems.27

Enterprise B2B identity

Use WorkOS, Frontegg, or Stytch when federation, directory lifecycle, customer administration, or organization-first authentication drives the design.

Enterprise identity integrations and B2B-primary authentication benefit from organization-centered connection and lifecycle models.

Verify: Validate whether provider tenant concepts match the product's contractual tenant boundary.3456

边界： Organization identity primitives are not a complete multi-tenancy architecture and do not replace authorization or data isolation.

关键差异

把真正会改变决策的边界单独比较。

Identity membership
Providers can manage users joining organizations and selecting active context.12
Product tenancy
Billing, entitlements, resource ownership, and workflow state remain domain concerns.37
Isolation
Database and authorization enforcement must not rely only on client-selected organization context.7
Enterprise mapping
SSO connections and directory groups need an explicit mapping to the application's tenant.345

官方资源

官方文档与继续决策的正式路径。

DocumentationClerk Organizations

来源

支撑页面关键主张的资料。

  1. 1
    Better Auth organization plugin

    Better Auth · Accessed Official

  2. 2
    Clerk Organizations

    Clerk · Accessed Official

  3. 3
    WorkOS users and organizations

    WorkOS · Accessed Official

  4. 4
    Frontegg tenants API

    Frontegg · Accessed Official

  5. 5
    Stytch B2B Organizations

    Stytch · Accessed Official

  6. 6
    Stytch SCIM overview

    Stytch · Accessed Official

  7. 7
    Clerk multi-tenant architecture

    Clerk · Accessed Official