Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura
Tags: authorization, graphql, guidesandtutorials
Published: 2021-11-29 13:40:53

---
title: Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura
published: true
date: 2021-10-21 14:32:25 UTC
tags: Authorization,GraphQL,GuidesAndTutorials
canonical_url: https://hasura.io/blog/implementing-authorization-for-organization-based-team-based-or-tenant-based-apps-in-hasura/
---

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://hasura.io/blog/content/images/2021/10/implementing_auth-1.png)

*This article was originally published on the Hasura blog. If there are formatting errors in the article below, we urge you to please go to [our blog and read it there](https://hasura.io/blog/implementing-authorization-for-organization-based-team-based-or-tenant-based-apps-in-hasura/). Thanks!* :)

<!--kg-card-begin: markdown-->
# Table of Contents

- [Introduction](#introduction)
- [Example Data](#example-data)
- [Relationships](#relationships)
- [Permissions](#permissions)
- [Query Results](#query-results)

## Introduction

This blog post is the first in a 2-part series that aims to outline how to model a common organization-based permission system in Hasura. Keep your eyes peeled for the second part for a walkthrough of a clonable sample repo that you can use to model similar permissions systems.

The problem being solved is:

> "In my application, I have a _'group'_ and entities that belong to group(s)."
> 
> "Each entity in the group should only be able to see/interact with other entities in the same group(s)."

This is a common pattern in applications and in this article we'll take a look at one of the ways you can solve it. Our solution will use nothing but Hasura's standard permissions system and authorization rules.

This approach and principle works for any **"group"-like structure** , such as:

- Teams
- Organizations
- Tenants in a Multi-tenant app
- Chat group-messages, & more!

Let's assume that you have some table structure like the following:

| Table Name | Columns | Foreign Keys |
| --- | --- | --- |
| `user` | `id`, `name`, `email` | |
| `organization_user` | `id`, `user_id`, `organization_id` | `user_id` -> `user.id`, `organization_id` -> `organization.id` |
| `organization` | `id`, `name` | |

## Example Data

Here we have example users:

- `John` & `Jane` belong to Organization ID `1`
- `Frank` belong to Organization ID `2`

We create the following database records:

- `user`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601026-8679c880-6f01-11ea-82ad-25ca0411ce26.png)

- `organization_user`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601031-8bd71300-6f01-11ea-82ca-191e4ddb5e35.png)

- `organization`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601045-942f4e00-6f01-11ea-8900-a9d8c15b27c8.png)

## Relationships

We create the following relationships on our data:

- `user`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601068-9db8b600-6f01-11ea-9bb4-6cf4cd8f9e95.png)

- `organization_user`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601057-9a252f00-6f01-11ea-8f97-5972d0bb21d5.png)

- `organization`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601074-a4472d80-6f01-11ea-9f80-071b43d64a16.png)

## Permissions

And provision the permissions like such:

- `user`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601086-ac9f6880-6f01-11ea-82aa-d171502de47e.png)

- `organization_user`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601100-b45f0d00-6f01-11ea-9231-c62f8b332c1a.png)

- `organization`

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601092-af9a5900-6f01-11ea-92b4-578aca118332.png)

## Query Results

Now when we query with our `X-Hasura-User-Id` set as User `1` and `3` respectively, we can see only those users in our own organizations:

- Querying as `John` (User ID 1, Org 1)

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601103-b6c16700-6f01-11ea-9cff-82b05c5b6914.png)

- Querying as `Frank` (User ID 3, Org 2)

![Implementing Authorization for Organization-based, Team-based, or Tenant-based Apps in Hasura](https://user-images.githubusercontent.com/26604994/77601108-b88b2a80-6f01-11ea-868e-c775c86b9041.png)

Voila! We've successfully implemented an organization-based authorization system using Hasura!

The previous article in our authorization cookbook explains [how to implement a hierarchical Google Drive-style permission system in Hasura using ACL](https://hasura.io/blog/implementing-a-google-drive-style-hierarchical-role-based-acl-system/).

If you have any questions or want to share your thoughts on the topic, reach out to us on [Twitter](http://https://twitter.com/HasuraHQ) / [Discord](http://https://discord.gg/6WV8J7bZ) / [GitHub Discussions](http://https://github.com/hasura/graphql-engine/discussions).

<!--kg-card-end: markdown-->