Almost every SaaS app has the same shape:



organization → team → project → resource






And almost every one hits the same authorization wall: if I make someone an admin of
an organization, they should automatically be an admin of every project inside it — not
just the org row in my database.

Most RBAC libraries don't do this. They model flat...