Organizations

An organization is the top-level tenant. Every resource in Project88 — agents, conversations, pages, data tables, provider keys, integrations — is scoped to an org.

What an org owns

• Members with one of three roles: owner, admin, member.
• One or more workspaces (a default is auto-created).
• Provider API keys for the LLM providers you've connected.
• Integrations (OAuth connections to Gmail, Calendar, Slack, etc.).
• Billing plan — free, pro, or enterprise. Usage is tracked in usage_logs per-org for token-based billing.
• Display metadata — icon_name (Lucide icon) and color for the picker UI.

How orgs are created

On signup we auto-create:

1. A profile row linked to your Supabase Auth user.
2. A personal organization ("Personal Org" by default).
3. An org_members row making you the owner.
4. A default workspace inside that org.

This is wired up with three Postgres triggers (handle_new_user, handle_new_user_org, handle_new_org_workspace), so the first time you land on /dashboard you already have a complete environment to work in.

You can create additional orgs from the dashboard or the org switcher in the breadcrumb.

How membership works

Org membership is stored in the org_members table — a join between auth.users and organizations with a role column. Owners and admins can:

• Invite and remove members
• Edit org name, slug, icon, color
• Manage provider keys and integrations
• Change the billing plan
• Delete the org

Regular members can read everything in the org and create their own resources (agents, pages, data) but can't change org-level config.

Invitations live in their own table; see Members and roles.

Switching orgs

The current org is persisted to localStorage and reflected in the URL:

/:orgSlug/:wsSlug/home

Switch orgs from:

• The breadcrumb dropdown (top-left of the canvas).
• The dashboard (/dashboard).
• The org settings modal (Settings → General).

Switching navigates to the new org's URL and reloads agents, pages, data, conversations, and provider keys.

Security & isolation

Every Project88 table has Row Level Security enabled. Policies enforce that you can only read or write rows whose org_id matches an org you're a member of. Writes that modify org-level config (members, billing, provider keys) additionally check that you're an owner or admin.

The org_members table itself uses a security-definer helper to break a recursive RLS dependency (migration 013), but the user-facing policy is still strict: you only see members of orgs you're in.