how does your app currently determine whether a user has access to a particular organization?