Yeah I was definitely thinking about it wrong. The question I was trying to ask was “is the user a member of an organization” which does not fit the model of “can user x do whatever to resource y”. Starting from that template got me where I needed to go