Permission systems become hard to maintain when roles are named after people or every feature invents a new access rule.
Model responsibilities, not individuals
Define roles around stable responsibilities such as member management, billing, content publishing or workspace administration. People can change; the responsibility remains understandable.
Enforce scope with the operation
Hiding a button is useful feedback, not authorization. Every server-side operation must authenticate the actor, validate the input and authorize the exact resource being read or changed.
For multi-tenant data, include the organization or owner scope in the database query itself. Fetching a record first and checking ownership afterwards makes the safe boundary easier to bypass.
Test the negative paths
The highest-value authorization tests prove that one workspace cannot read or change another workspace's data. Add those tests whenever a new resource or mutation is introduced.