Organization authorization hardening
Pro Prisma and Pro Drizzle now enforce a shared owner, admin, member and outsider permission policy across destructive actions, billing, member management and logo uploads.
Both starter kits now use one explicit organization permission policy for owner-only and owner-or-admin actions. The release also closes an upload-signing gap that allowed an authenticated client to choose an arbitrary image object path.
What changed
- Restricted organization deletion and its danger-zone interface to the owner.
- Kept billing, invitations, member management and organization-logo updates available to organization owners and organization admins.
- Prevented organization admins from modifying an owner or assigning the owner role.
- Stopped global application administrators from inheriting access to an organization unless they are also a member of it.
- Replaced the generic image upload signer with purpose-specific avatar and organization-logo procedures. Object paths are now generated on the server from the authenticated user or active organization.
- Hid organization-logo controls from members who cannot update the organization.
Permission matrix
| Action | Owner | Admin | Member | Outsider |
|---|---|---|---|---|
| Delete organization | Yes | No | No | No |
| Manage billing | Yes | Yes | No | No |
| Invite or revoke members | Yes | Yes | No | No |
| Change roles | Yes | Limited | No | No |
| Upload organization logo | Yes | Yes | No | No |
Verification
The Prisma and Drizzle editions include focused tests for the complete role matrix and Better Auth's enforced organization permissions. Both applications passed Oxlint, TypeScript checks, the permission suite and production builds with Next.js 16.3.0.
Existing projects
No database migration or configuration change is required. Existing projects can adopt the shared permission helpers, purpose-specific upload procedures and updated organization settings call sites from this release.
Read the organization guidance for Pro Prisma or Pro Drizzle.