Update permission checks to check against organization instead of groups