[Decision] What is an authenticated session with NO active organization? Three subsystems answered it three contradictory ways in one shift (fail-open / fail-closed / permanently-invisible ledger rows) #8247

Filed by the triage seat (scheduled fire, session session_01BJ9jjXsUuc4Mkiyzvv1xUW, 2026-08-12 ~22:47Z round). This decision has no single natural anchor — it sits upstream of three measured cards in three subsystems — so it gets a standalone card per the escalation protocol.

Background

One and the same state — an authenticated session whose activeOrganizationId is null — produced three different, mutually contradictory behaviors, all measured live on 2026-08-12:

None of the three implementations is individually wrong; the platform has never declared what the state means, so each layer improvised. The state is structurally guaranteed to occur: better-auth defers the ADR-0093 membership reconciler past the signup transaction, so every new user's first session predates their membership (ADR-0081 D1 defaultActiveOrg finds no sys_member row). It can also arise later (member removed from their org, etc.), so it cannot be defined away by fixing signup alone.

Premises (re-check before ruling)

• The signup ordering is still live: git log --oneline -5 -- packages/plugin-auth/src and re-read AuthManager.composeDatabaseHooks / the ADR-0093 reconciler for a synchronous-settle change.
• plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158's reject-direction fix is merged: check PR fix(plugin-sharing): a manage_sharing holder with no active organization no longer reads every tenant's sharing rules (#8158) #8237 state.
• A record an admin creates over HTTP is immediately invisible to its own creator when the caller has no active organization and the Layer 0 wall is active (organization_id stamped NULL) #8208 / audit: a user's FIRST session predates their membership, so every audit row written in that window carries a NULL tenant and is invisible to RLS readers #8245 are still open findings with no disposition: re-read both cards.

The question

Is "authenticated, but no active organization" a legal session state with defined semantics, or an illegal intermediate to be eliminated at the mint point?

Options

• A. Illegal — eliminate at source. Settle membership (or an explicit org selection) before the first session mints; reject or refresh sessions that lose their org. Closes the whole class, but touches the signup hot path and better-auth's deferred-hook ordering; and "member removed mid-session" still needs an answer.
• B. Legal, with declared fail-closed semantics. Write the rule down (ADR-class): under this state, tenant-scoped reads resolve to nothing, tenant-scoped writes are refused loudly (no silent NULL stamping). plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158's landed fix already conforms; A record an admin creates over HTTP is immediately invisible to its own creator when the caller has no active organization and the Layer 0 wall is active (organization_id stamped NULL) #8208's silent NULL stamp becomes a 4xx refusal; audit writes need a carve-out (see C) because refusing to write a ledger row loses history.
• C. B + a targeted signup-ordering fix. The general rule is B, and specifically for signup the membership settles synchronously before the first session (or the ledger row's tenant is back-filled once the session gains its org), because account-creation audit rows are exactly the ones a fail-closed refusal would permanently lose.

Recommendation: C

• Platform long-term coherence: one declared rule replaces three improvisations, and the next subsystem that meets this state inherits an answer instead of inventing a fourth. A alone cannot cover the non-signup producers of the state.
• Measured business pull: three independent hits in one working day, one of them (plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158) a cross-tenant security leak — this is not speculative surface.
• AI-agent error-resistance: a declared fail-closed contract with loud refusals is exactly the shape agents cannot silently get wrong; today's silent NULL stamp (A record an admin creates over HTTP is immediately invisible to its own creator when the caller has no active organization and the Layer 0 wall is active (organization_id stamped NULL) #8208) is the archetype of the quiet corruption this axis exists to prevent.
• Startup scope discipline: C adds no new capability — it is one ruling plus one ordering fix; the per-user "pick your org" UX and multi-org session semantics stay out of scope.

Security/permission-boundary semantics ⇒ human floor; not auto-adjudicable.

Downstream

Disposition of findings #8208 and #8245 is gated on this ruling; #8158's fix stands either way. Related: #8241 (RLS policy-composition trap, same family but a different mechanism — not gated on this).