Hi team! Looking for architectural guidance on a multi-tenant setup. I've reviewed the multi-tenant docs (Multi-tenant Access Policy) and MSO blog post (Multi-tenant MSO), but they don't address my specific admin hierarchy issue. Our Structure: Me (Project Super Admin): Creates bots, access policies, global config, manages entire project Org Admins: MUST be restricted to their organization only - can invite/manage their own team members but cannot see other orgs Regular Users: Organization employees with restricted access What the Docs Don't Cover: The multi-tenant examples show non-admin users with AccessPolicies, but don't address how to handle organization administrators who need elevated permissions within their org scope but must remain isolated from other organizations. Current Issue: Org admins with "admin": true bypass all AccessPolicy restrictions and see admin resources across ALL organizations. This breaks tenant isolation entirely. What Works: Organization resources properly compartmentalized ✅ AccessPolicy resources properly restricted ✅ Other resources respect _compartment filtering ✅ What Doesn't Work: ProjectMembership with _compartment=%current_organization - admin users ignore this completely ❌ Critical Problem: Admin users get unrestricted access to: PasswordChangeRequest, UserSecurityRequest, Project, ProjectMembership, User. This means org admins can see all users across organizations and access project-level settings. Question: How do I create organization administrators who have admin-level permissions within their organization scope but are completely isolated from other organizations? The current admin flag is all-or-nothing and breaks multi-tenancy. Thanks! 🙏

Hey @snowhey , I can help you out here. Quick preliminary question before digging deeper: In your self hosted setup, are you using your single super-admin Project for all of this, a single separate non-super-admin project, or multiple projects?

Hey @finnbergquist , thanks for your response. here’s our setup: we’re using a single non–super-admin project with one main project admin. That project admin adds Org Admins for each tenant/org. The issue is that as soon as those Org Admins have ProjectMembership.admin = true, their AccessPolicy is ignored(https://github.com/medplum/medplum/blob/main/packages/server/src/fhir/accesspolicy.ts#L215). When they query the ProjectMembership endpoint, they see all users from all orgs, not just their own — which breaks tenant isolation. What we’d like is for Org Admins to only manage their own org’s users (invite/manage within their compartment) without gaining project-wide visibility or control. Right now the only workaround we see is to keep one true project admin, make Org Admins non-admin users scoped by AccessPolicy, and handle invites via bots/ClientApps. Is that the right pattern, or is there a cleaner way to achieve proper org-level admin isolation?

Ahh, I gotcha. Yea, you are correct that admin Users get unrestricted access to

{
      resourceType: 'ProjectMembership',
      readonlyFields: ['project', 'user'],
    },

    {
      resourceType: 'PasswordChangeRequest',
      readonly: true,
    },

    {
      resourceType: 'UserSecurityRequest',
      readonly: true,
    },

    {
      resourceType: 'User',
      hiddenFields: ['passwordHash', 'mfaSecret'],
      readonlyFields: ['email', 'emailVerified', 'mfaEnrolled', 'project'],
    }

The pattern that I have seen is creating your own invite endpoint(authing with ClientApplication) or bot, that has a ProjectMembership.admin = true. But still keeping your "Org Admins" as non-admins.