Why org_id must be derived, never accepted
If an organization identifier can be supplied in a tool argument, the assistant can be persuaded to supply a different one. Deriving it from verified membership removes that entire class of problem: the caller cannot name a tenant, only be one.
Ambiguity has to fail closed too. An identity that resolves to more than one organization is not a licence to pick one.
Role is about capability, not visibility
Agent access makes menu-based thinking dangerous, because an assistant never sees a menu. It calls the endpoint directly. The only meaningful role check is the one that asks whether this role holds this named capability, evaluated where the data lives.
Entitlement is a third, different question
- Permission asks: may this person do this.
- Entitlement asks: does this business have this module at all.
- A permitted user on a plan without the module should still be refused.
- Refusals should be explicit, so the assistant reports a reason instead of guessing.