Need help modelling a B2B SAAS

[doronoded]

Hi,
I can't seem to get my head around this modelling use case. Didn't get much luck with the different LLMs, and was hoping I'll find help here..
I am trying to model a multi-tenant B2B SAAS similar to a CRM let's say. So, in this use case we have users (regular and managers), organizations (crm (my) customers), customers (organization's customers (my customer's customers)) and teams. Users are related to organizations as users, and are assigned (either directly or via teams) to customers (that they manage). Customers are also assigned to organizations. Users that are assigned to customers should obviously also be assigned to that customer's organization. Users can also be assigned to teams, that are manages by manager users. Manager users have access to all of the team's users customers that they manage. User may be assigned to more than one customer, and more than one team. A team may also be assigned to customers (plural).

Please help me model this.

[aaguiarz]

If I understand correctly, this can be a good start

  model
    schema 1.1
    
  type user
  type organization
    relations
      define member : [user]

  type customer
    relations
      # organization's customers
      define organization : [organization]
      define member : [user, team#member]
      define manager : [user]

  type team 
    relations
      define customer : [customer]
      define member : [user]
      define can_manage : manager from customer

This example in the model guide is similar (but it does not have the 'customer' level).

https://github.com/openfga/sample-stores/blob/main/stores/modeling-guide/step-3-groups.fga.yaml

The Modeling Guide goes step by step in defining a model for a multi tenant app https://github.com/openfga/sample-stores/tree/main/stores/modeling-guide

Let me know if it helps, thanks!

[doronoded]

Thank you very much! But looking at the customer relations, how do I make suelre the member is not any user, but a user from the customer's organization?

…

On Sun, Mar 30, 2025, 15:45 Andrés Aguiar ***@***.***> wrote: If I understand correctly, this can be a good start model schema 1.1 type user type organization relations define member : [user] type customer relations # organization's customers define organization : [organization] define member : [user, team#member] define manager : [user] type team relations define customer : [customer] define member : [user] define can_manage : manager from customer This example in the model guide is similar (but it does not have the 'customer' level). https://github.com/openfga/sample-stores/blob/main/stores/modeling-guide/step-3-groups.fga.yaml The Modeling Guide goes step by step in defining a model for a multi tenant app https://github.com/openfga/sample-stores/tree/main/stores/modeling-guide Let me know if it helps, thanks! — Reply to this email directly, view it on GitHub <#444 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAZ7XVNXDIUSGNIDIZN3C7L2W7ROHAVCNFSM6AAAAAB2B3U3I2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENRWG4ZDQNA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[aaguiarz]

Depends on what you want to achieve. If you want to add all customers members as organization members, then you can do "manager'.

``
type customer
relations
# organization's customers
define organization : [organization]
define member : [user, team#member]
define manager : [user] and member from organization

In general, members from an organization are different than members from your customers. If you want to allow some members of the organization to perform admin tasks in each customers, you can do:

type organization
relations
define manager : [user]

type customer
relations
# organization's customers
define organization : [organization]
define member : [user, team#member]
define manager : [user] or manager from organization

I would not `customer` members as `organization` members. 

If a user can be a member of two orgs/two customers, check this example to see how you can send the current one as a contextual tuple https://openfga.dev/docs/modeling/organization-context-authorization

Does it help?

[doronoded]

I am sorry, I am trying to start fresh and I don't understand something.. let's start simple.. I've defined only 3 entities: organization, customer and users... I am starting modeling the basics.. I want to define users as members of organizations. customers are related to "owner" organizations, and members of customers are one or more members in their respective organizations:

model
  schema 1.1

type user

type organization
  relations
    define member: [user]

type customer
  relations
    define org: [organization]
    define member: member from org
    define manager: member from org

Now I've added the following tuples:

user: user:1
relation: member
object: organization:1

user: user:2
relation: member
object: organization:1

user: organization:1
relation: org
customer: 1

So far I've defined 2 users (1,2) that are part of organization:1, and customer (1) that is "owned" by organization:1. Now I want to have user:1 to be a also a member of customer:1. But when I try to add this tuple:

user: user:1
relation: member
object: customer:1

I get this error: Something went wrong! Error creating tuple, try again later: Invalid tuple 'customer:1#member@user:1'. Reason: type 'user' is not an allowed type restriction for 'customer#member'

Why?
I want members of customer:1 to be also members of the "owner" org - which is this is organization:1...

*** EDIT ***

OK, I know why :)
the member and manager should have been defined like so:
define member: [user] and member from org
In my original definition, there was no need to add the last tuple, because it basically said "all users that members of org:1 are members of customer:1 as well".
So now, I think the Organization, Customer and User definition holds. Now I was trying to add the teams like so:

model
  schema 1.1

type user

type organization
  relations
    define member: [user]
    define team: [team]

type customer
  relations
    define org: [organization]
    define member: ([user] and member from org) or ([team#member] and team from org)
    define manager: ([user] and member from org) or ([team#manager] and team from org)
    
type team
  relations
    define org: [organization]
    define member: [user] and member from org
    define manager: [user] and member from org
    

So, the reason I've added team relation also in organization, so that just like user, I want the assigned_team in customer to only be a team that is related to that org - i.e. [team#member and team from org].
I also had to define the org relation in the team to enforce that users that are member or manager in team are only users that related to that org. right?

But... unfortunately this model isn't valid.. I get an error in the member and manager relations in customer (see attached). why? how should this be defined? and what do you think about this modeling in general please?

[aaguiarz]

Right, I think you actually do not need to define

type customer
  relations
    define org: [organization]
    define team: [team] and team from org

you can just do

type customer
  relations
    define org: [organization]
    define team: [team] 

because in 'member from team' you are already checking for Org membership:

type team
  relations
    define org: [organization]
    define member: [user] and member from org
    define manager: [user] and member from org

So, it would be

type user

type organization
relations
  define member: [user]
  define team: [team]

type customer
relations
  define org: [organization]
  define team: [team] 
  define member: ([user] and member from org) or member from team
  define manager: ([user] and member from org) or manager from team

type team
relations
  define org: [organization]
  define member: [user] and member from org
  define manager: [user] and member from org

[doronoded]

Thanks!
But then I would be able to mistakenly relate team from org A to a customer that is managed by org B.. wouldn't I?

[doronoded]

@aaguiarz, I am sorry for bugging you :) but I think this example could really use as reference for other SAAS companies considering using Open FGA. I am really trying to understand how to fulfill the "Teams" entity into the model..

[doronoded]

@aaguiarz, is there another way to model this?

[aaguiarz]

Hi @doronoded

I did not find a way to represent what you want to do.

In general, you don't build a model assuming the tuples could be wrong. For example, if you add the wrong user to an organization/team, they'll get permissions, and you can't build a model that verifies that. Before writing tuples, you'd validate they are correct. That simplifies the model and improves performance a lot.

e.g. the model without the validations would be:

  type user
  type organization

  type customer
    relations
      define team: [team]
      define member: [user] or member from team 
      define manager: [user] or manager from team

  type team
  relations
    define member: [user] 
    define manager: [user]