user:* needs to be scoped to the organization, so organization#member like you said