Real-world org structure. SubOrg, SPV, JV — natively.
Most IAM tools fake B2B by tagging users with a tenant_id. Real enterprises have parents, subsidiaries, special-purpose vehicles, regional offices, joint ventures, and matrix reporting. B2B Organizations models that complexity natively, with cryptographically isolated permissions at every level of the tree.
Recommended tier: T1 Standard → T2 Defense
Category: Identity & Access
What B2B Organizations does
Hierarchical SubOrg tree
Parent, subsidiary, sub-subsidiary, regional office, JV — modeled as a real tree, not a flat tag.
SPC / SPV isolation
Special-purpose companies and vehicles get their own cryptographic boundary. Voting, board minutes, and notarized contracts isolated from the parent.
Delegated master seals
Master seal authority delegable to subsidiary leadership without exposing the parent's seal.
Cross-border role mapping
Same person, different role per jurisdiction. Permissions evaluated per-region with sealed audit per move.
Inheritance with override
Permissions cascade down the tree by default; subsidiaries can override or restrict but never escalate beyond parent grant.
Per-org MFA & policy
Each SubOrg sets its own MFA policy, session timeout, and required attestation level.
Architecture in one paragraph
Define your org tree once — usually mirroring the legal entity chart. Assign users at any node; permissions inherit downward. Each node has its own sealed audit log; auditors can scope their query to a single subsidiary or the whole group.
Three concrete deployments
Multinational parent + 12 subsidiaries
Each subsidiary admin manages their own users; group-level compliance team has read-only audit across all.
SPV / SPC for joint venture
JV partners get cryptographically isolated permissions; parent shareholders have audit visibility but no operational write.
Holding company + portfolio
PE-style portfolio: each portco an isolated org with own seal; group-level reporting via Audit Analytics rollup.
T1 Standard → T2 Defense
Most B2B deployments work at T1 with managed identity. Public-company SubOrg structures with SOX scope move to T2 with hardware attestation per subsidiary.
Versus what's deployed today
Today — Tenant-tag tricks · multiple Auth0 tenants
Subsidiaries either share a flat tenant (no isolation) or get separate tenants (no inheritance, no rollup, no group SSO).
With DPSM — B2B Organizations
True hierarchy with cryptographic isolation between branches. Inheritance, override, and audit rollup all native. One identity per person across the entire group.