diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index e9f3a1a..dd41002 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -31,7 +31,7 @@ Package manager: **Bun** (`bun.lock`). Usar `bun`, nunca `npm`/`yarn`.
 
 ### Módulos (DDD ligero)
 
-La lógica de negocio vive en `src/modules/<nombre>/` (`auth`, `config`, `projects`, `storage`), cada uno separado en:
+La lógica de negocio vive en `src/modules/<nombre>/` (`auth`, `config`, `organization`, `projects`, `storage`), cada uno separado en:
 
 - `domain/` — entidades (`entities.ts`), interfaces de repositorio (`repositories.ts`), clases de dominio (`*.domain.ts`)
 - `application/` — servicios que orquestan el dominio (`*.service.ts`) — esto es lo que llaman las rutas
@@ -53,11 +53,22 @@ Env vars (`.env.example`): `GITDB_REPOSITORY_URL` (obligatoria), `GITDB_ENCRYPTI
 
 ### Puerta de acceso global
 
-`src/hooks.server.ts`: inicializa gitdb, resuelve usuario desde la cookie `pos_session`, redirige a `/login` si no hay sesión, y restringe `/settings/*` + `/api/system/*` a admins.
+`src/hooks.server.ts`: inicializa gitdb, resuelve usuario desde la cookie `pos_session`, redirige a `/login` si no hay sesión, valida permisos de proyecto/organización en rutas `/org/*/projects/*/settings` y `/org/*/settings`, y restringe `/settings/*` + `/api/system/*` a admins.
 
 ## RBAC / Permisos
 
-Permisos = strings `section:action` (`vault|openreport|stateiac` : `read|create|update|delete`) o el atajo `section:all`, definidos en `src/lib/permissions/index.ts`. Roles en gitdb (`.gitdb/roles.json`), gestionados por `roleService`.
+Permisos = strings con formato global (`vault:read`), organización (`organization:projects:all`) o proyecto (`project:vault:secrets:read`), definidos en `src/lib/permissions/index.ts`. Roles en gitdb (`.gitdb/roles.json`), gestionados por `roleService`.
+
+**Roles de organización** (`scope: 'organization'`) se crean automáticamente al crear organización (`createDefaultOrganizationRoles`):
+- `org-admin`: permisos completos (`organization:projects:all`, `organization:users:all`, etc.)
+- `org-developer`: lectura/creación/actualización de proyectos (`organization:projects:read|create|update`)
+
+**Roles de proyecto** (`scope: 'project'`) se crean automáticamente al crear proyecto (`createDefaultProjectRoles`):
+- `project-admin`: permisos completos a nivel de proyecto
+- `project-developer`: lectura/creación/actualización de vault/state/code report (sin delete ni gestión de roles)
+- `project-viewer`: solo lectura en todos los recursos del proyecto
+
+**Control de acceso a organizaciones**: `cancanService.organizationIdsForUser(user)` devuelve los IDs de organizaciones a las que el usuario puede acceder (directo o a través de proyectos), o `null` para admins sin restricción. Se usa en rutas como `/org` para filtrar contenido.
 
 ```typescript
 // ✅ patrón correcto en un endpoint (api/roles, api/projects, api/backends)
diff --git a/CLAUDE.md b/CLAUDE.md
index 2cb1c85..e49ea5d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -50,7 +50,7 @@ La lógica de negocio vive en `src/modules/<nombre>/`, cada uno separado en:
 | `infrastructure/repositories/` | Implementaciones concretas de repositorio                              |
 | `index.ts`                     | **Composition root** del módulo: instancia repositorios + servicios y exporta singletons |
 
-Módulos existentes: `auth`, `config`, `projects`, `storage`.
+Módulos existentes: `auth`, `config`, `organization`, `projects`, `storage`.
 
 **Regla de acceso**: las rutas y otros módulos importan únicamente desde el `index.ts` de cada módulo (p. ej. `import { can, isAdmin, roleService } from '../../modules/auth'`), nunca de `application/`, `domain/` o `infrastructure/` directamente.
 
@@ -79,19 +79,33 @@ Variables de entorno (`.env.example`): `GITDB_REPOSITORY_URL` (obligatoria, lanz
 1. Inicializa gitdb (`getGitDb()` a nivel de módulo, una sola vez).
 2. Deja pasar `/login` y `/api/auth/*` sin sesión.
 3. Resuelve el usuario desde la cookie `pos_session` (`authService.resolveAuthenticatedUser`); si no hay usuario válido, redirige (302) a `/login`.
-4. Restringe `/settings/*` y `/api/system/*` a admins (`canAccessAdminArea`).
+4. Valida permisos de proyecto para rutas `/org/[org]/projects/[slug]/settings` (`canManageProject`); si no tiene acceso, redirige a `/`.
+5. Restringe `/org/[org]/settings` a usuarios con permiso de organización (`canManageOrganization`); si no, redirige a `/`.
+6. Restringe `/settings/*` y `/api/system/*` a admins (`canAccessAdminArea`).
 
 ---
 
 ## RBAC / Permisos
 
-Los permisos son strings `section:action` (p. ej. `vault:read`) o el atajo `section:all`, definidos en `src/lib/permissions/index.ts`:
+Los permisos son strings `section:action` (p. ej. `vault:read`) o el atajo `section:all`, definidos en `src/lib/permissions/index.ts`. El formato soporta dos niveles de scope:
 
-- `section` ∈ `vault | openreport | stateiac`
-- `action` ∈ `read | create | update | delete`
+- **Global**: `section:action` donde `section` ∈ `vault | openreport | stateiac`
+- **Organización**: `organization:action` (p. ej. `organization:projects:read`, `organization:users:all`)
+- **Proyecto**: `project:action` (p. ej. `project:vault:secrets:read`, `project:stateiac:stacks:all`)
+
+Roles a nivel de organización (`scope: 'organization'`) se crean automáticamente al crear una organización (método `RoleService.createDefaultOrganizationRoles`):
+- `org-admin`: permisos completos a nivel de organización (`organization:projects:all`, `organization:users:all`, `organization:roles:all`, etc.)
+- `org-developer`: lectura, creación y actualización de proyectos (`organization:projects:read|create|update`)
+
+Roles a nivel de proyecto (`scope: 'project'`) se crean automáticamente al crear un proyecto (método `RoleService.createDefaultProjectRoles`):
+- `project-admin`: permisos completos a nivel de proyecto (vault, state/IaC, code report, usuarios, roles, auditoría)
+- `project-developer`: permisos de lectura, creación y actualización para vault/state/code report (sin permisos de eliminación ni gestión de roles)
+- `project-viewer`: permisos de lectura exclusivamente en todos los recursos del proyecto
 
 Los roles (y su array de `permissions`) viven en gitdb (`.gitdb/roles.json`), gestionados por `roleService`. El rol `admin` es especial: no se puede borrar (`RoleService.deleteRole` lo bloquea explícitamente) y `isAdmin(user)` comprueba `user.role.slug === 'admin'`.
 
+**Control de acceso a organizaciones**: `CanCanService.organizationIdsForUser(user)` devuelve los IDs de organizaciones a las que un usuario tiene acceso — directo (vía rol de organización) o indirecto (vía rol en un proyecto). Devuelve `null` para admins de cluster (sin restricción). Se usa en rutas como `/org` para filtrar qué organizaciones ve el usuario.
+
 **Patrón correcto en un endpoint** (todas las rutas bajo `api/roles`, `api/projects`, `api/backends` lo siguen):
 
 ```typescript
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 3651215..e58e580 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1,6 +1,7 @@
 import type { Handle } from '@sveltejs/kit';
 import { authService, cancanService, ensureAuthReady } from './modules/auth';
 import { ensureOrganizationReady, organizationService } from './modules/organization';
+import { projectService } from './modules/projects';
 import { getGitDb } from '$lib/server/gitdb';
 
 getGitDb();
@@ -43,8 +44,20 @@ export const handle: Handle = async ({ event, resolve }) => {
     return new Response(null, { status: 302, headers: { location: '/login' } });
   }
 
+  const projectSettingsMatch = event.url.pathname.match(
+    /^\/org\/[^/]+\/projects\/([^/]+)\/settings/,
+  );
   const organizationSettingsMatch = event.url.pathname.match(/^\/org\/([^/]+)\/settings/);
-  if (organizationSettingsMatch) {
+
+  if (projectSettingsMatch) {
+    const project = await projectService.tryFindBySlug(projectSettingsMatch[1]);
+    if (
+      !project ||
+      !(await cancanService.canManageProject(currentUser, project.id, project.organization?.id))
+    ) {
+      return new Response(null, { status: 302, headers: { location: '/' } });
+    }
+  } else if (organizationSettingsMatch) {
     const organization = await organizationService.tryFindBySlug(organizationSettingsMatch[1]);
     if (
       !organization ||
diff --git a/src/lib/components/AppNavbar.svelte b/src/lib/components/AppNavbar.svelte
index 1659b32..6afdd58 100644
--- a/src/lib/components/AppNavbar.svelte
+++ b/src/lib/components/AppNavbar.svelte
@@ -175,7 +175,7 @@
                 <Building2 class="h-4 w-4" />
                 Change Organization
               </a>
-              <form action="/api/auth/logout" method="POST" on:submit={closeUserDropdown}>
+              <form action="/api/auth/logout" method="POST">
                 <button
                   type="submit"
                   class="btn-ghost flex w-full items-center gap-2 px-4 py-3 text-left text-sm font-medium text-red-600 hover:bg-red-50"
diff --git a/src/lib/components/AppSidebar.svelte b/src/lib/components/AppSidebar.svelte
index 2143062..e2c1ff2 100644
--- a/src/lib/components/AppSidebar.svelte
+++ b/src/lib/components/AppSidebar.svelte
@@ -21,7 +21,6 @@
     Users,
     Layers,
     HardDrive,
-    Bot,
     ShieldAlert,
   } from 'lucide-svelte';
 
@@ -34,6 +33,9 @@
   export let collapsed = true;
   export let organizationSlug: string | null = null;
   export let organizationName: string | null = null;
+  export let canAccessClusterSettings = false;
+  export let canManageOrganization = false;
+  export let canManageProject = false;
   export let currentProjectSlug: string | null = null;
   export let projects: {
     slug: string;
@@ -151,7 +153,7 @@
           },
         ]
       : []),
-    ...(currentProjectSlug
+    ...(currentProjectSlug && canManageProject
       ? [
           {
             name: 'Proyecto',
@@ -186,7 +188,7 @@
     {
       name: 'Sistema',
       modules: [
-        ...(organizationSlug
+        ...(organizationSlug && canManageOrganization
           ? [
               {
                 name: 'Organization Settings',
@@ -226,22 +228,26 @@
               },
             ]
           : []),
-        {
-          name: 'Cluster Settings',
-          icon: Building2,
-          items: [
-            { label: 'Organizations', href: '/cluster-settings/orgs', icon: Building2 },
-            {
-              label: 'Roles & Permissions',
-              href: '/cluster-settings/roles-permissions',
-              icon: Shield,
-            },
-            { label: 'Users', href: '/cluster-settings/users', icon: Users },
-          ],
-        },
+        ...(canAccessClusterSettings
+          ? [
+              {
+                name: 'Cluster Settings',
+                icon: Building2,
+                items: [
+                  { label: 'Organizations', href: '/cluster-settings/orgs', icon: Building2 },
+                  {
+                    label: 'Roles & Permissions',
+                    href: '/cluster-settings/roles-permissions',
+                    icon: Shield,
+                  },
+                  { label: 'Users', href: '/cluster-settings/users', icon: Users },
+                ],
+              },
+            ]
+          : []),
       ],
     },
-  ] satisfies NavCategory[];
+  ].filter((category) => category.modules.length > 0) satisfies NavCategory[];
 
   function isItemActive(href: string) {
     return currentPath.startsWith(href);
diff --git a/src/modules/auth/application/cancan.service.test.ts b/src/modules/auth/application/cancan.service.test.ts
index 06d3408..073c349 100644
--- a/src/modules/auth/application/cancan.service.test.ts
+++ b/src/modules/auth/application/cancan.service.test.ts
@@ -35,6 +35,7 @@ function access(input: {
   scope: 'organization' | 'project';
   organizationId?: string;
   projectId?: string;
+  project?: { id: string; organizationId: string };
 }) {
   return new UserAccessDomain({
     id: input.id,
@@ -44,6 +45,14 @@ function access(input: {
     scope: input.scope,
     organizationId: input.organizationId,
     projectId: input.projectId,
+    project: input.project
+      ? {
+          id: input.project.id,
+          name: input.project.id,
+          slug: input.project.id,
+          organization: { id: input.project.organizationId, name: '', slug: '' },
+        }
+      : undefined,
     createdAt: '2024-01-01T00:00:00.000Z',
     updatedAt: '2024-01-01T00:00:00.000Z',
   });
@@ -192,4 +201,54 @@ describe('CanCanService', () => {
     ).resolves.toBe(false);
     await expect(service.can('jose', 'stateiac:read', { scope: 'cluster' })).resolves.toBe(true);
   });
+
+  describe('organizationIdsForUser', () => {
+    it('returns null for a cluster admin (no restriction)', async () => {
+      const jose = user({ id: 'jose', role: role({ id: 'admin', slug: 'admin' }) });
+      await expect(service.organizationIdsForUser(jose)).resolves.toBeNull();
+    });
+
+    it('returns an empty list for a user with no access rows', async () => {
+      const jose = user({ id: 'jose', role: null });
+      await expect(service.organizationIdsForUser(jose)).resolves.toEqual([]);
+    });
+
+    it('collects organizations from direct organization access', async () => {
+      const jose = user({ id: 'jose', role: null });
+      userAccessRepository.rows.push(
+        access({
+          id: 'access-1',
+          userId: 'jose',
+          scope: 'organization',
+          organizationId: 'gitops',
+          role: role({ id: 'org-developer', slug: 'org-developer', scope: 'organization' }),
+        }),
+      );
+
+      await expect(service.organizationIdsForUser(jose)).resolves.toEqual(['gitops']);
+    });
+
+    it('collects the parent organization from project access, deduplicated', async () => {
+      const jose = user({ id: 'jose', role: null });
+      userAccessRepository.rows.push(
+        access({
+          id: 'access-1',
+          userId: 'jose',
+          scope: 'project',
+          projectId: 'kettu',
+          project: { id: 'kettu', organizationId: 'gitops' },
+          role: role({ id: 'project-admin', slug: 'project-admin', scope: 'project' }),
+        }),
+        access({
+          id: 'access-2',
+          userId: 'jose',
+          scope: 'organization',
+          organizationId: 'gitops',
+          role: role({ id: 'org-developer', slug: 'org-developer', scope: 'organization' }),
+        }),
+      );
+
+      await expect(service.organizationIdsForUser(jose)).resolves.toEqual(['gitops']);
+    });
+  });
 });
diff --git a/src/modules/auth/application/cancan.service.ts b/src/modules/auth/application/cancan.service.ts
index 2342439..771ff6d 100644
--- a/src/modules/auth/application/cancan.service.ts
+++ b/src/modules/auth/application/cancan.service.ts
@@ -1,4 +1,4 @@
-import type { Permission } from '$lib/permissions';
+import type { PermissionGrant } from '$lib/permissions';
 import type { ProjectDomain } from '../../projects/domain/project.domain';
 import type { RoleDomain } from '../domain/role.domain';
 import type { UserDomain } from '../domain/user.domain';
@@ -43,7 +43,7 @@ export class CanCanService {
     private readonly projectLookup?: ProjectLookup,
   ) {}
 
-  async can(userId: string, permission: Permission, context: CanCanContext): Promise<boolean> {
+  async can(userId: string, permission: PermissionGrant, context: CanCanContext): Promise<boolean> {
     const user = await this.userRepository.findById(userId);
     if (!user) return false;
 
@@ -52,7 +52,7 @@ export class CanCanService {
 
   async canSessionUser(
     user: PermissionAwareUser,
-    permission: Permission,
+    permission: PermissionGrant,
     context: CanCanContext,
   ): Promise<boolean> {
     if (!user?.id) return false;
@@ -70,6 +70,38 @@ export class CanCanService {
     return this.canSessionUser(user, 'stateiac:read', { scope: 'organization', organizationId });
   }
 
+  async canManageProject(
+    user: PermissionAwareUser,
+    projectId: string,
+    organizationId?: string,
+  ): Promise<boolean> {
+    return this.canSessionUser(user, 'project:project:read', {
+      scope: 'project',
+      projectId,
+      organizationId,
+    });
+  }
+
+  // organizationIds this user is a member of, directly or via a project under that organization.
+  // returns null for a cluster admin, meaning "no restriction, sees every organization".
+  async organizationIdsForUser(user: PermissionAwareUser): Promise<string[] | null> {
+    if (!user?.id) return [];
+    if (this.isClusterAdmin(user.role ?? null)) return null;
+
+    const access = await this.userAccessRepository.findByUserId(user.id);
+    const organizationIds = new Set<string>();
+
+    for (const entry of access) {
+      if (entry.scope === 'organization' && entry.organizationId) {
+        organizationIds.add(entry.organizationId);
+      } else if (entry.scope === 'project' && entry.project?.organization?.id) {
+        organizationIds.add(entry.project.organization.id);
+      }
+    }
+
+    return Array.from(organizationIds);
+  }
+
   canAccessAdminArea(user: PermissionAwareUser): boolean {
     return this.isAdmin(user);
   }
@@ -80,7 +112,7 @@ export class CanCanService {
 
   async canForUser(
     user: UserDomain,
-    permission: Permission,
+    permission: PermissionGrant,
     context: CanCanContext,
   ): Promise<boolean> {
     if (this.isClusterAdmin(user.role)) return true;
@@ -123,7 +155,7 @@ export class CanCanService {
       .filter((role): role is RoleDomain => Boolean(role));
   }
 
-  private roleCan(role: PermissionRole, permission: Permission): boolean {
+  private roleCan(role: PermissionRole, permission: PermissionGrant): boolean {
     if (!role) return false;
     if (this.isAdminRole(role)) return true;
     return CanCanService.hasPermission(role.permissions, permission);
@@ -140,7 +172,7 @@ export class CanCanService {
 
   static hasPermission(
     grants: readonly string[] | null | undefined,
-    permission: Permission,
+    permission: PermissionGrant,
   ): boolean {
     if (!grants || grants.length === 0) return false;
 
diff --git a/src/modules/auth/application/role.service.test.ts b/src/modules/auth/application/role.service.test.ts
index 58d1ace..b6aba65 100644
--- a/src/modules/auth/application/role.service.test.ts
+++ b/src/modules/auth/application/role.service.test.ts
@@ -193,4 +193,63 @@ describe('RoleService', () => {
     const roles = await service.listRoles();
     expect(roles.find((r) => r.id === created.id)).toBeUndefined();
   });
+
+  describe('createDefaultOrganizationRoles', () => {
+    it('creates the org-admin and org-developer roles scoped to the organization', async () => {
+      await service.createDefaultOrganizationRoles('org-1');
+
+      const roles = await service.listRoles('organization', 'org-1');
+      expect(roles.map((role) => role.slug).sort()).toEqual(['org-admin', 'org-developer']);
+
+      const admin = roles.find((role) => role.slug === 'org-admin');
+      expect(admin.permissions).toEqual(
+        expect.arrayContaining([
+          'organization:projects:all',
+          'organization:users:all',
+          'organization:roles:all',
+        ]),
+      );
+
+      const developer = roles.find((role) => role.slug === 'org-developer');
+      expect(developer.permissions).toEqual([
+        'organization:projects:read',
+        'organization:projects:create',
+        'organization:projects:update',
+      ]);
+    });
+  });
+
+  describe('createDefaultProjectRoles', () => {
+    it('creates the project-admin, project-developer and project-viewer roles scoped to the project', async () => {
+      await service.createDefaultProjectRoles('project-1');
+
+      const roles = await service.listRoles('project', 'project-1');
+      expect(roles.map((role) => role.slug).sort()).toEqual([
+        'project-admin',
+        'project-developer',
+        'project-viewer',
+      ]);
+
+      const admin = roles.find((role) => role.slug === 'project-admin');
+      expect(admin.permissions).toEqual(
+        expect.arrayContaining(['project:project:all', 'project:users:all', 'project:roles:all']),
+      );
+
+      const developer = roles.find((role) => role.slug === 'project-developer');
+      expect(developer.permissions).toEqual(
+        expect.arrayContaining([
+          'project:vault:secrets:read',
+          'project:vault:secrets:create',
+          'project:vault:secrets:update',
+        ]),
+      );
+      expect(developer.permissions).not.toContain('project:vault:secrets:delete');
+      expect(developer.permissions).not.toContain('project:roles:all');
+
+      const viewer = roles.find((role) => role.slug === 'project-viewer');
+      expect(viewer.permissions.every((permission: string) => permission.endsWith(':read'))).toBe(
+        true,
+      );
+    });
+  });
 });
diff --git a/src/modules/auth/application/role.service.ts b/src/modules/auth/application/role.service.ts
index a0fc5c0..b1e49c8 100644
--- a/src/modules/auth/application/role.service.ts
+++ b/src/modules/auth/application/role.service.ts
@@ -4,6 +4,80 @@ import type { RoleRepository } from '../infrastructure/repositories/role.reposit
 import type { UserRepository } from '../infrastructure/repositories/user.repository';
 import type { RoleScope } from '../domain/role.domain';
 
+const ORGANIZATION_ADMIN_PERMISSIONS = [
+  'organization:projects:all',
+  'organization:users:all',
+  'organization:roles:all',
+  'organization:backups:all',
+  'organization:server-keys:all',
+  'organization:audit:all',
+];
+
+const ORGANIZATION_DEVELOPER_PERMISSIONS = [
+  'organization:projects:read',
+  'organization:projects:create',
+  'organization:projects:update',
+];
+
+const PROJECT_ADMIN_PERMISSIONS = [
+  'project:project:all',
+  'project:users:all',
+  'project:roles:all',
+  'project:server-keys:all',
+  'project:audit:all',
+  'project:vault:secrets:all',
+  'project:vault:environments:all',
+  'project:codereport:reports:all',
+  'project:codereport:dependencies:all',
+  'project:codereport:vulnerabilities:all',
+  'project:stateiac:stacks:all',
+  'project:stateiac:states:all',
+  'project:stateiac:history:all',
+];
+
+const PROJECT_DEVELOPER_PERMISSIONS = [
+  'project:vault:secrets:read',
+  'project:vault:secrets:create',
+  'project:vault:secrets:update',
+  'project:vault:environments:read',
+  'project:vault:environments:create',
+  'project:vault:environments:update',
+  'project:codereport:reports:read',
+  'project:codereport:reports:create',
+  'project:codereport:reports:update',
+  'project:codereport:dependencies:read',
+  'project:codereport:dependencies:create',
+  'project:codereport:dependencies:update',
+  'project:codereport:vulnerabilities:read',
+  'project:codereport:vulnerabilities:create',
+  'project:codereport:vulnerabilities:update',
+  'project:stateiac:stacks:read',
+  'project:stateiac:stacks:create',
+  'project:stateiac:stacks:update',
+  'project:stateiac:states:read',
+  'project:stateiac:states:create',
+  'project:stateiac:states:update',
+  'project:stateiac:history:read',
+  'project:stateiac:history:create',
+  'project:stateiac:history:update',
+];
+
+const PROJECT_VIEWER_PERMISSIONS = [
+  'project:project:read',
+  'project:users:read',
+  'project:roles:read',
+  'project:server-keys:read',
+  'project:audit:read',
+  'project:vault:secrets:read',
+  'project:vault:environments:read',
+  'project:codereport:reports:read',
+  'project:codereport:dependencies:read',
+  'project:codereport:vulnerabilities:read',
+  'project:stateiac:stacks:read',
+  'project:stateiac:states:read',
+  'project:stateiac:history:read',
+];
+
 export class RoleService {
   constructor(
     private readonly roleRepository: Pick<
@@ -80,6 +154,52 @@ export class RoleService {
     return created.toJson();
   }
 
+  // called right after an organization is created, so it always has its base roles
+  async createDefaultOrganizationRoles(organizationId: string): Promise<void> {
+    await this.createRole({
+      name: 'Org Admin',
+      slug: 'org-admin',
+      scope: 'organization',
+      organizationId,
+      permissions: ORGANIZATION_ADMIN_PERMISSIONS,
+    });
+
+    await this.createRole({
+      name: 'Org Developer',
+      slug: 'org-developer',
+      scope: 'organization',
+      organizationId,
+      permissions: ORGANIZATION_DEVELOPER_PERMISSIONS,
+    });
+  }
+
+  // called right after a project is created, so it always has its base roles
+  async createDefaultProjectRoles(projectId: string): Promise<void> {
+    await this.createRole({
+      name: 'Project Admin',
+      slug: 'project-admin',
+      scope: 'project',
+      projectId,
+      permissions: PROJECT_ADMIN_PERMISSIONS,
+    });
+
+    await this.createRole({
+      name: 'Project Developer',
+      slug: 'project-developer',
+      scope: 'project',
+      projectId,
+      permissions: PROJECT_DEVELOPER_PERMISSIONS,
+    });
+
+    await this.createRole({
+      name: 'Project Viewer',
+      slug: 'project-viewer',
+      scope: 'project',
+      projectId,
+      permissions: PROJECT_VIEWER_PERMISSIONS,
+    });
+  }
+
   async updateRole(id: string, changes: { name?: string; permissions?: string[] }): Promise<any> {
     const role = await this.roleRepository.findById(id);
     if (!role) {
diff --git a/src/modules/projects/application/project.service.ts b/src/modules/projects/application/project.service.ts
index 1a69f28..56c5a59 100644
--- a/src/modules/projects/application/project.service.ts
+++ b/src/modules/projects/application/project.service.ts
@@ -44,6 +44,12 @@ export class ProjectService {
     return project.toJson();
   }
 
+  // non-throwing variant, for callers that should degrade gracefully (e.g. hooks.server.ts)
+  async tryFindBySlug(slug: string) {
+    const project = await this.repository.findBySlug(slug);
+    return project ? project.toJson() : null;
+  }
+
   async createProject(input: {
     organizationId: string;
     name: string;
diff --git a/src/routes/+layout.server.ts b/src/routes/+layout.server.ts
index e6a7e53..44cb4eb 100644
--- a/src/routes/+layout.server.ts
+++ b/src/routes/+layout.server.ts
@@ -20,6 +20,10 @@ export async function load({ locals, url }) {
     ? await organizationService.tryFindBySlug(orgSlugFromUrl)
     : await organizationService.getDefaultOrganization();
 
+  const canAccessClusterSettings = cancanService.canAccessAdminArea(locals.user);
+  const canManageOrganization = organization
+    ? await cancanService.canManageOrganization(locals.user, organization.id)
+    : false;
   const currentProjectSlug = url.pathname.match(/\/projects\/([^/]+)/)?.[1] ?? null;
 
   const projects = locals.user
@@ -41,6 +45,18 @@ export async function load({ locals, url }) {
         .map(({ project }) => project)
     : [];
 
+  const projectSlugFromUrl = url.pathname.match(/^\/org\/[^/]+\/projects\/([^/]+)/)?.[1];
+  const currentProject = projectSlugFromUrl
+    ? projects.find((project) => project.slug === projectSlugFromUrl)
+    : null;
+  const canManageProject = currentProject
+    ? await cancanService.canManageProject(
+        locals.user,
+        currentProject.id,
+        currentProject.organization?.id,
+      )
+    : false;
+
   return {
     // isConfigured: !!config && backends.length > 0,
     isConfigured: true,
@@ -49,6 +65,9 @@ export async function load({ locals, url }) {
     user: locals.user,
     organization,
     projects,
+    canAccessClusterSettings,
+    canManageOrganization,
+    canManageProject,
     currentProjectSlug,
   };
 }
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 44bdcb0..bfa545d 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -45,6 +45,9 @@
           organizationSlug={data.organization?.slug ?? null}
           organizationName={data.organization?.name ?? null}
           projects={data.projects}
+          canAccessClusterSettings={data.canAccessClusterSettings}
+          canManageOrganization={data.canManageOrganization}
+          canManageProject={data.canManageProject}
           currentProjectSlug={data.currentProjectSlug ?? null}
           bind:collapsed={sidebarCollapsed}
         />
diff --git a/src/routes/+page.server.ts b/src/routes/+page.server.ts
index d9ab3b0..b3d9a5a 100644
--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@@ -1,10 +1,48 @@
 import { redirect } from '@sveltejs/kit';
 import { organizationService } from '../modules/organization';
+import { cancanService } from '../modules/auth';
 
-export async function load() {
-  const organization = await organizationService.getDefaultOrganization();
-  if (!organization) {
-    throw redirect(302, '/cluster-settings/orgs');
+export async function load({ locals, parent }) {
+  const allowedOrganizationIds = await cancanService.organizationIdsForUser(locals.user);
+
+  // cluster admins have no organization-scoped access rows to check — keep landing them
+  // on the default organization's overview, same as before.
+  if (allowedOrganizationIds === null) {
+    const organization = await organizationService.getDefaultOrganization();
+    if (!organization) {
+      throw redirect(302, '/cluster-settings/orgs');
+    }
+    throw redirect(302, `/org/${organization.slug}/overview`);
+  }
+
+  if (allowedOrganizationIds.length === 0) {
+    throw redirect(302, '/org');
   }
-  throw redirect(302, `/org/${organization.slug}/overview`);
+
+  const organizations = await organizationService.listOrganizations();
+  const accessibleOrganizations = organizations.filter((organization) =>
+    allowedOrganizationIds.includes(organization.id),
+  );
+
+  // The org overview requires an organization-scope permission. A user whose only access
+  // is to specific projects shows up as "accessible" here but would still 403 there —
+  // land them on an org they can actually view, in the order they were granted access.
+  for (const organization of accessibleOrganizations) {
+    if (await cancanService.canManageOrganization(locals.user, organization.id)) {
+      throw redirect(302, `/org/${organization.slug}/overview`);
+    }
+  }
+
+  // No organization-scope access anywhere — send them straight to a project they can
+  // actually open instead of into a 403 on an overview page they can't see.
+  const { projects } = await parent();
+  const firstProject = projects[0];
+  if (firstProject?.organization?.slug) {
+    throw redirect(
+      302,
+      `/org/${firstProject.organization.slug}/projects/${firstProject.slug}/overview`,
+    );
+  }
+
+  throw redirect(302, '/org');
 }
diff --git a/src/routes/api/organizations/+server.ts b/src/routes/api/organizations/+server.ts
new file mode 100644
index 0000000..c3de0c5
--- /dev/null
+++ b/src/routes/api/organizations/+server.ts
@@ -0,0 +1,44 @@
+import { json } from '@sveltejs/kit';
+import { organizationService } from '../../../modules/organization';
+import { cancanService, roleService } from '../../../modules/auth';
+
+export async function GET({ locals }) {
+  if (!cancanService.canAccessAdminArea(locals.user)) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  try {
+    const organizations = await organizationService.listOrganizations();
+    return json({ organizations });
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return json({ error: message }, { status: 500 });
+  }
+}
+
+export async function POST({ request, locals }) {
+  if (!cancanService.canAccessAdminArea(locals.user)) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  try {
+    const data = (await request.json()) as {
+      name?: string;
+      slug?: string;
+      description?: string;
+    };
+
+    const organization = await organizationService.createOrganization({
+      name: String(data.name || ''),
+      slug: data.slug ? String(data.slug) : undefined,
+      description: data.description ? String(data.description) : undefined,
+    });
+
+    await roleService.createDefaultOrganizationRoles(organization.id);
+
+    return json({ success: true, organization });
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return json({ error: message }, { status: 400 });
+  }
+}
diff --git a/src/routes/api/projects/+server.ts b/src/routes/api/projects/+server.ts
new file mode 100644
index 0000000..e71499f
--- /dev/null
+++ b/src/routes/api/projects/+server.ts
@@ -0,0 +1,60 @@
+import { json } from '@sveltejs/kit';
+import { projectService } from '../../../modules/projects';
+import { cancanService, roleService } from '../../../modules/auth';
+
+export async function GET({ url, locals }) {
+  if (!(await cancanService.canSessionUser(locals.user, 'stateiac:read', { scope: 'cluster' }))) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  try {
+    const organizationId = url.searchParams.get('organizationId');
+    const projects = organizationId
+      ? await projectService.listProjectsByOrganization(organizationId)
+      : await projectService.listProjects();
+    return json({ projects });
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return json({ error: message }, { status: 500 });
+  }
+}
+
+export async function POST({ request, locals }) {
+  try {
+    const data = (await request.json()) as {
+      organizationId?: string;
+      name?: string;
+      slug?: string;
+      description?: string;
+      status?: string;
+      modules?: { vault?: boolean; openreport?: boolean; stateiac?: boolean };
+    };
+
+    const canCreate = data.organizationId
+      ? await cancanService.canSessionUser(locals.user, 'stateiac:create', {
+          scope: 'organization',
+          organizationId: data.organizationId,
+        })
+      : await cancanService.canSessionUser(locals.user, 'stateiac:create', { scope: 'cluster' });
+
+    if (!canCreate) {
+      return json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const project = await projectService.createProject({
+      organizationId: String(data.organizationId || ''),
+      name: String(data.name || ''),
+      slug: data.slug ? String(data.slug) : undefined,
+      description: data.description ? String(data.description) : undefined,
+      status: data.status ? String(data.status) : undefined,
+      modules: data.modules,
+    });
+
+    await roleService.createDefaultProjectRoles(project.id);
+
+    return json({ success: true, project });
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return json({ error: message }, { status: 400 });
+  }
+}
diff --git a/src/routes/org/+page.server.ts b/src/routes/org/+page.server.ts
index 217317a..57d7539 100644
--- a/src/routes/org/+page.server.ts
+++ b/src/routes/org/+page.server.ts
@@ -1,6 +1,14 @@
 import { organizationService } from '../../modules/organization';
+import { cancanService } from '../../modules/auth';
+
+export async function load({ locals }) {
+  const allOrganizations = await organizationService.listOrganizations();
+  const allowedOrganizationIds = await cancanService.organizationIdsForUser(locals.user);
+
+  const organizations =
+    allowedOrganizationIds === null
+      ? allOrganizations
+      : allOrganizations.filter((organization) => allowedOrganizationIds.includes(organization.id));
 
-export async function load() {
-  const organizations = await organizationService.listOrganizations();
   return { organizations };
 }
diff --git a/src/routes/org/+page.svelte b/src/routes/org/+page.svelte
index 153738d..6cc28c1 100644
--- a/src/routes/org/+page.svelte
+++ b/src/routes/org/+page.svelte
@@ -35,9 +35,13 @@
 
   {#if data.organizations.length === 0}
     <div
-      class="rounded-md border border-dashed border-slate-300 bg-slate-50 px-4 py-6 text-sm text-slate-600"
+      class="flex flex-col items-center gap-2 rounded-md border border-dashed border-slate-300 bg-slate-50 px-4 py-10 text-center"
     >
-      No organizations found.
+      <Building2 class="h-8 w-8 text-slate-400" />
+      <p class="text-sm font-medium text-slate-700">You don't belong to any organization yet</p>
+      <p class="max-w-sm text-sm text-slate-500">
+        Ask an administrator to add you to an organization to get started.
+      </p>
     </div>
   {:else}
     <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
diff --git a/src/routes/org/[org]/overview/+page.server.ts b/src/routes/org/[org]/overview/+page.server.ts
index 5d25f99..6674801 100644
--- a/src/routes/org/[org]/overview/+page.server.ts
+++ b/src/routes/org/[org]/overview/+page.server.ts
@@ -14,7 +14,7 @@ export async function load({ locals, parent }) {
     throw error(403, 'Forbidden');
   }
 
-  const projects = await projectService.listProjects();
+  const projects = await projectService.listProjectsByOrganization(organization.id);
   const activeProjects = projects.filter((project) => project.status === 'active');
 
   return { projects: activeProjects };