skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

organization-membership-security

Manage SaaS organization memberships with RBAC, lifecycle, and audit trails.

Updated Mar 29, 2026
Search Tags:#security#audit#rbac#lifecycle#membership#tenant#offboarding
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill organization-membership-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: organization-membership-security
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/organization-membership-security
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill organization-membership-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Managing membership across tenants securely is complex: you need strict authorization on who can invite, promote, or remove members, and you must guard against last-owner loss, ensure a tamper-evident audit trail, and perform complete offboarding.

Core Features & Use Cases

  • Membership data model with tenant_id, user_id, role, status, and an immutable audit log of changes.
  • Role hierarchy enforcement and self-change prevention to prevent privilege escalation and accidental demotions.
  • Last-owner protection to prevent tenants from becoming inaccessible.
  • Atomic offboarding workflow that revokes sessions, API keys, invites, and reassigns resources as configured.
  • Reversible suspension flow that blocks access while preserving data ownership.

Quick Start

Invite a member to a tenant with a specific role and confirm the action complies with the role hierarchy.

Frequently Asked Questions about organization-membership-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely manage SaaS organization memberships across multiple tenants?▼

Secure SaaS organization memberships by enforcing strict RBAC, role hierarchy, and tenant-scoped access revocation. This ensures only authorized users can invite, promote, or remove members across multiple tenants.

How does role-based access control prevent privilege escalation in tenant management?▼

Role-based access control prevents privilege escalation by enforcing a strict role hierarchy and preventing self-changes. This blocks unauthorized promotions or accidental demotions within tenant environments.

Can I temporarily suspend a member without permanently deleting their data ownership?▼

Yes, a reversible suspension flow blocks access while preserving data ownership. This allows temporary access restrictions without executing a full offboarding or data removal process.

How do I prevent the last owner from being removed and locking a tenant?▼

Last-owner protection guards against tenant inaccessibility by preventing the removal or demotion of the final remaining owner. This ensures the tenant always retains administrative control.

Does organization membership security provide an audit trail for role changes and invites?▼

Yes, it enforces a membership data model with an immutable audit log of changes. This provides a tamper-evident audit trail for all role changes, invites, and offboarding actions.

What is the best way to handle complete user offboarding in a multi-tenant SaaS application?▼

The best way is an atomic offboarding workflow that revokes sessions, API keys, and invites while reassigning resources. This ensures complete access revocation across the tenant.

Related Skills

Explore More Software Engineering Skills→
awudevelopawudevelop

authhub

Configure multi-tenant authentication and organization management for Supabase applications.

Community
Advanced
aks-buildsaks-builds
1

audit-logging

Design HIPAA-compliant audit logging solutions with SIEM integration and tamper-evident logging.

Community
Advanced
marquesfelipmarquesfelip

tenant-suspension-handling

Automate tenant suspension workflows from billing or abuse signals.

Community
Advanced
GELLIFYGELLIFY
6

organization-best-practices

Configure multi-tenant organizations, teams, and role-based access control with Better Auth.

Official
Advanced