I have a multi-tenant application, with users and teams. Currently the only permissions I use are an is_admin flag on the user, and a team_admin flag on the user-team relationship.

I want to add more fine-grained permissions, granting specific actions per team, and overall for the organisation. For example, “send_emails”, “add_users”, or “team.{id}.add_users”, “team.{id}.update_event”.

Best in mind these permissions are scoped per organisation, and a user can be in multiple organisations.

Would any of the permissions/roles packages suit this well or should I just roll my own? I’m leaning more towards DIY at the moment.