In Hasura, you authenticate externally -- can be custom API endpoint that signs a JWT/auth webhook, or an auth provider like Auth0, Okta, Firebase, Keycloak, etc. Doesn't matter, just have to return some claims values.

You can then use these claims values in your authorization (permissions) layer.

IE, when a user logs in, you can sign a claim with "X-Hasura-User-ID" = 1, and "X-Hasura-Org-ID" = 5, and then put rules on tables like:

  > "Role USER can SELECT rows in table 'user' WHEN X-Hasura-User-ID = user.id"

  > "Role USER can SELECT rows in table 'organization' WHEN X-Hasura-Org-Id = organization.id"

There's more depth to it than this, but this is the gist of it.