Model Hierarchical Multi-Tenancy

Hey everyone
Whats the best way to model this business on zitadel.
Workspace -> Merchants -> operator
Where operators might have different roles on each merchant

Ask Inkeep•11/25/25, 11:23 PM

Hi @Marcelo, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

Ask Inkeep•11/25/25, 11:23 PM

Answer

I wasn't able to find a direct answer, here are some relevant sources:

Authentication and authorization in multi-tenancy B2B scenarios (1) : Shows how to model B2B scenarios where organizations can have departments and users with different roles across projects using Organizations and Project Grants.
Retrieve User Roles in ZITADEL (2) : Explains how users can receive authorizations from multiple organizations and how user grants combine users with projects and roles.

Ask Inkeep•11/25/25, 11:25 PM

To learn more, see the sources I considered:

[1] Authentication and authorization in multi-tenancy B2B scenarios
[2] Retrieve User Roles in ZITADEL

Ask Inkeep•11/25/25, 11:25 PM

Feel free to tag @Ask Inkeep with additional questions.

MarceloOP•11/26/25, 12:25 AM

May i use project to represent merchants? @Ask Inkeep

Ask Inkeep•11/26/25, 12:25 AM

Thanks for the follow-up, @Marcelo. I'll get back to you soon.

Ask Inkeep•11/26/25, 12:25 AM

Answer

I wasn't able to find a direct answer, here are some relevant sources:

Organize applications, services, and roles with projects (1) : Explains that projects are vessels for closely related components where applications share the same roles, grants, and authorizations.
ZITADEL Projects (2) : Describes how projects group applications and how granted organizations can manage selected roles for your project on their own.

Ask Inkeep•11/26/25, 12:25 AM

To learn more, see the sources I considered:

[1] Organize applications, services, and roles with projects
[2] ZITADEL Projects

Ask Inkeep•11/26/25, 12:25 AM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] Organize applications, serv...

Ask InkeepAPP•11/26/25, 12:39 AM

Got it. Tagging @Rajat for additional help.

Rajat•11/26/25, 11:44 AM

hey @Marcelo
In zitadel,
Instance: Your Workspace
Organizations: Each Merchant (separate org per merchant)
Project: Your applications that operators (users) use
Roles: Different operator roles (defined in your Project)
Authorizations: Assign operators(users) specific roles for each merchant orgs

You can read about it here we are on the work to rewrite our guides so if you read it and give us some feedback that will also help us but reading that should help you with your modelling. Thanks

MarceloOP•11/26/25, 1:56 PM

Thanks a lot, @Rajat , your explanation helped, but I realize I didn’t clarify one key point about my domain.

In my system, we will not have a single global workspace.
We will have many workspaces, and each workspace represents an economic group / corporate group (a customer account in B2B terms).

The hierarchy is:

Workspace = a tenant for an economic group (customer account).
Example: “Acme Group Workspace”

Merchants = multiple legal entities / stores / brands that belong to that workspace.
Example: “Acme Store SP”, “Acme Store RJ”, “Acme Online”, all under the same workspace.

Operators (users) are invited to a workspace, and inside that workspace they can have different roles per merchant.

does that change the modeling, and RBAC?

Rajat•12/2/25, 11:08 AM

hey @Marcelo you raised valid points, apologies for the delay, let me think for a bit and I will get back to you.