Multi-Tenant SaaS Architecture in Next.js: Organizations, Roles, and Resource Isolation

Multi-tenancy is one of those features that sounds simple and isn't. Organizations, team members, role-based access, shared resources -- done wrong, it's a security nightmare. Here's the pattern that works. The Data Model Everything starts with the right schema. The core structure: Users belong to Organizations through Memberships. model Organization { id String @id @default(cuid()) name String slug String @unique // URL-safe identifier plan String @default("free") createdAt DateTime @default(now()) updatedAt DateTime @updatedAt members Membership[] invites OrgInvite[] // Your product resources: projects Project[] apiKeys ApiKey[] } model Membership { id String @id @default(cuid()) userId String organizationId String role OrganizationRole @default(MEMBER) createdAt DateTime @default(now()) user User @relation(fields: [userId], references: [id], onDelete: Cascade) organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade) @@unique([userId, organiz