> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization Roles

> Learn how organization roles work in Auth0, including the two-tier role model, limits, and access control boundaries.

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Organization Roles" stage="ea" terms="true" contact="Auth0 Support" />

<Card title="Availability varies by Auth0 plan">
  Your Auth0 plan or custom agreement affects whether this feature is available. To learn more, read [Pricing](https://auth0.com/pricing).
</Card>

Organization Roles allow you to define roles that exist only within a specific [Organization](/docs/manage-users/organizations/organizations-overview). Unlike tenant roles, which apply across your entire tenant, Organization roles are scoped to a single Organization. This allows users to hold different roles in each Organization.

## Role model

Auth0 uses a two-tier role model when Organizations are enabled:

* [Tenant roles](/docs/get-started/manage-dashboard-access/feature-access-by-role#dashboard-roles) exist at the tenant level and can assign those roles to any user across all Organizations.
* Organization roles exist within a specific Organization and apply only to members of the specific Organization.

When a user logs in through an Organization, their access token includes permissions from the roles you assign them within that Organization. These may be tenant roles, Organization roles, or both. If no Organization context is present in the authentication request, only tenant roles apply and token behavior remains unchanged.

## Permissions

Organization roles use the same permission model as tenant roles. Permissions come from your API resource servers and are assigned to a role. A user inherits the permissions of every Organization role they hold within that Organization at login.

To learn how to add permissions to a role, read [Add Permissions to Roles](/docs/manage-users/access-control/configure-core-rbac/roles/add-permissions-to-roles).

## Access control

Only tenant admins can create, edit, and delete Organization roles. Organization editors can assign and remove Organization roles for members within their Organization but cannot create or modify the roles themselves.

## Limits

| Resource                            | Limit                      |
| ----------------------------------- | -------------------------- |
| Organization roles per Organization | 350                        |
| Permissions per Organization role   | Same limit as tenant roles |

## Learn more

* [Create Roles](/docs/manage-users/access-control/configure-core-rbac/roles/create-roles)
* [Add Roles to Organization Members](/docs/manage-users/organizations/configure-organizations/add-member-roles)
* [Assign Roles for Enterprise Groups](/docs/manage-users/access-control/configure-core-rbac/rbac-users/assign-roles-to-groups)
* [Send Organization Membership Invitations](/docs/manage-users/organizations/configure-organizations/send-membership-invitations)
* [Work with Tokens and Organizations](/docs/manage-users/organizations/using-tokens)
* [Role-Based Access Control](/docs/manage-users/access-control/rbac)