like if you'd check access at the organization level, you'd just attach the role binding to the org