← All practicals

Run a tenant: orgs, roles & invites

Create an organization, invite a teammate by email, and see role-based guardrails enforced server-side.

1. 1

   On the Organizations lab, create an org — you become its first owner.

   Real B2B software is multi-tenant: a customer is an organization, not a single account. Creating one mints your first ACTIVE membership at the highest role, owner.

2. 2

   Invite a teammate by email at the member or admin role.

   Only admin+ may invite, and only an owner may ever grant the owner role itself — least-privilege admin actions, enforced server-side even though the button is hidden client-side too.

3. 3

   Try to remove or demote another admin (or the owner) — watch it get refused.

   An admin can only act on strictly lower-ranked members — never a peer or superior. That’s RBAC’s classic guardrail against a compromised admin account escalating sideways.

4. 4

   As the sole owner, try to leave or demote yourself — see the last_owner error.

   An org can never lose its last owner. The only way out is to promote a co-owner first — the same invariant real tenant-admin consoles enforce to avoid an orphaned, unmanageable org.