Teams and organizations

In a B2B app, data belongs to a company, not to a person. Ada and Grace both work at Acme and should see the same projects; Bob at Globex must never see them. Some people belong to several companies and switch between them. You’ll build that: organizations, invitations with roles, a projects table scoped to the active organization, with admins allowed to delete and members only to read and edit. You’ll use: Organizations, Invitations, access rules, named rules. Before you start: do An app with signed-in users or be comfortable with sign-in and table rules.

How it works

Every session acts in one organization at a time. The access token carries it, and your rules read it:

In a rule	Holds
`$auth.org`	The organization’s slug the session is acting in, or empty
`$auth.org_role`	The person’s role in it: `viewer`, `member`, `admin` or `owner`

Each team table has an org column. The rule compares $record.org with $auth.org. Switching organization refreshes the token, and every rule follows.

1. Create the table

Data → Tables → Create table projects:

Column	Type	Notes
`org`	text, short	required, indexed
`name`	text, short	required
`status`	text, short	`active` by default

2. Write the rules once, as named rules

Open Policies → New policy and create three named rules: team_member: someone in the record’s organization.

All of these rules pass:
- Check a value: $auth.org is set
- Compare values: $record.org equals $auth.org

team_create: creating a record in your own organization.

All of these rules pass:
- Check a value: $auth.org is set
- Compare values: $input.org equals $auth.org

team_admin: an admin or owner of the record’s organization.

All of these rules pass:
- Check a value: $auth.org is set
- Compare values: $record.org equals $auth.org
- Compare values: $auth.org_role is one of admin, owner

As JSON, for the management client or infrastructure as code:

{ "name": "team_member", "condition": { "all": [ { "truthy": "$auth.org" }, { "eq": ["$record.org", "$auth.org"] } ] } }
{ "name": "team_create", "condition": { "all": [ { "truthy": "$auth.org" }, { "eq": ["$input.org", "$auth.org"] } ] } }
{ "name": "team_admin",  "condition": { "all": [ { "truthy": "$auth.org" }, { "eq": ["$record.org", "$auth.org"] },
                                                  { "in": ["$auth.org_role", ["admin", "owner"]] } ] } }

Never leave out the “is set” check. If someone has no active organization and a record has no org either, “$record.org equals $auth.org” compares two empty values, which is true, and they’d see every unassigned record. Requiring $auth.org closes that.

3. Apply them to the table

In projects → Access:

Operation	Rule
See the list	`team_member`
Open one record	`team_member`
Add records	`team_create`
Edit records	`team_member`
Delete records	`team_admin`

Because the edit rule reads org, members can’t move a project to another organization through the app. When someone signs up, create their organization and switch into it:

src/onboarding.ts

import { ConflictError } from "@pawabase/client";
import { pawabase } from "./pawabase";

export async function createCompany(name: string) {
  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
  try {
    await pawabase.auth.orgs.create({ slug, name });   // the creator becomes its owner
  } catch (e) {
    if (e instanceof ConflictError) throw new Error("That company name is taken; try another.");
    throw e;
  }
  await pawabase.auth.switchOrg(slug);                 // the session now acts in it
  return slug;
}

After switchOrg, the session’s org and org_role are set and TOKEN_REFRESHED fires.

5. Invite colleagues

An admin or owner invites by email, with a role:

await pawabase.auth.orgs.invite("acme", {
  email: "grace@acme.com",
  role: "member",                                   // viewer | member | admin | owner
  redirectTo: "https://app.example.com/accept-invite",
});

The email links to your accept-invite page with a token. The person signs in or signs up there, then your page accepts:

src/accept-invite.ts

const token = new URL(location.href).searchParams.get("token")!;
const session = await pawabase.auth.getSession();
if (!session) {
  location.assign(`/sign-in?next=${encodeURIComponent(location.pathname + location.search)}`);
} else {
  await pawabase.auth.orgs.acceptInvitation(token);
  await pawabase.auth.switchOrg("acme");             // or the slug the invitation was for
}

redirectTo must be one of your allowed addresses under Users & auth → Domains. See Invitations.

6. Work inside the organization

Create records with the active organization, and list without filters, since the rule filters for you:

src/projects.ts

import { pawabase } from "./pawabase";

export async function createProject(name: string) {
  const session = await pawabase.auth.getSession();
  if (!session?.org) throw new Error("Choose a company first");
  return pawabase.from("projects").create({ org: session.org, name });
}

export const listProjects = () => pawabase.from("projects").order("name");

7. Switch between organizations

src/switcher.ts

const orgs = await pawabase.auth.orgs.list();           // [{ slug, name, role }]
// when the person picks one:
await pawabase.auth.switchOrg(picked.slug);
// reload anything you cached: it belonged to the previous organization

Listen for TOKEN_REFRESHED in onAuthStateChange and reload lists, so nothing from the previous organization stays on screen. switchOrg(null) leaves organization mode. To sign straight into one: signInWithPassword({ email, password, org: "acme" }).

8. Files and live updates per organization

Use the same idea everywhere:

Files: put the organization first in the key (acme/contracts/2026.pdf) and use the rule $object.segments.0 equals$ auth.org (plus $auth.org is set) on the bucket. See Rules on storage.
Channels: name them org:acme:… and add a channel rule that requires the organization. See Rules on realtime.

9. Test the boundary

test/tenancy.test.ts

import { createClient, NotFoundError } from "@pawabase/client";

const client = () => createClient({ url: process.env.PAWABASE_URL!, apiKey: process.env.PAWABASE_PUBLISHABLE_KEY!, environment: "development" });

const ada = client();   // admin at acme
const bob = client();   // member at globex
await ada.auth.signInWithPassword({ email: "ada@acme.test", password: process.env.PW!, org: "acme" });
await bob.auth.signInWithPassword({ email: "bob@globex.test", password: process.env.PW!, org: "globex" });

const project = await ada.from("projects").create({ org: "acme", name: "Launch" });

// Bob can't see it, open it, or create in Acme
console.assert(!(await bob.from("projects")).data.some((p) => p.id === project.id));
await bob.from("projects").get(project.id).then(() => { throw new Error("leak"); }, (e) => console.assert(e instanceof NotFoundError));
await bob.from("projects").create({ org: "acme", name: "Sneaky" }).then(() => { throw new Error("leak"); }, () => {});

// No active organization: sees nothing
const adaNoOrg = client();
await adaNoOrg.auth.signInWithPassword({ email: "ada@acme.test", password: process.env.PW! });
console.assert((await adaNoOrg.from("projects")).data.length === 0);

The last check catches the “two empty values” trap.

Server-side and staff access

Your own backend acting for a person: pass their token, so the rules apply (Node.js).
Your support staff across all organizations: use a separate admin tool with a secret key, rather than adding a global role to customer-facing rules. If you must, add Any of: Has role platform_support; team_member.

Troubleshooting

Problem	Cause	Fix
Lists are empty after sign-in	The session has no active organization	`switchOrg(slug)` after sign-in, or sign in with `org`
Creating gives `403`	`org` in the body isn’t the active organization, or it’s missing	Send `org: session.org`
A member can’t delete	Intended: delete needs `team_admin`	Change the role, or the rule
After switching, old data shows	Cached lists from the previous organization	Reload on `TOKEN_REFRESHED`
An invited person sees nothing	They accepted but haven’t switched to the organization	Call `switchOrg` after accepting
Changing `org` gives `403`	Intended: the edit rule reads it	Move records from a server with a secret key

Organizations

Members, roles, teams and metadata.

Recipes: teams

More multi-tenant rules.

Welcome

Concepts

Quickstarts

Tutorials

Teams and organizations

How it works

1. Create the table

2. Write the rules once, as named rules

3. Apply them to the table

5. Invite colleagues

6. Work inside the organization

7. Switch between organizations

8. Files and live updates per organization

9. Test the boundary

Server-side and staff access

Troubleshooting

Organizations

Recipes: teams

​How it works

​1. Create the table

​2. Write the rules once, as named rules

​3. Apply them to the table

​4. Let a company sign up

​5. Invite colleagues

​6. Work inside the organization

​7. Switch between organizations

​8. Files and live updates per organization

​9. Test the boundary

​Server-side and staff access

​Troubleshooting

Organizations

Recipes: teams

How it works

1. Create the table

2. Write the rules once, as named rules

3. Apply them to the table

4. Let a company sign up

5. Invite colleagues

6. Work inside the organization

7. Switch between organizations

8. Files and live updates per organization

9. Test the boundary

Server-side and staff access

Troubleshooting