title: Nestjs: Access control based on the organization of a user
body: <p>I am writing my first API with NestJS and I am looking for a smart way of managing access to resources. I have the following simplified structure:</p>
  
  <ul>
  <li><p>organization:</p>
  
  <ul>
  <li>users</li>
  <li>products</li>
  </ul></li>
  <li><p>users:</p>
  
  <ul>
  <li>email</li>
  <li>organization</li>
  </ul></li>
  <li><p>products:</p>
  
  <ul>
  <li>organization</li>
  <li>more data</li>
  </ul></li>
  </ul>
  
  <p>I use Passport JWT and Local strategies. But I want to make sure only users from inside the organization can update and create products for that organization.</p>
  
  <p>I have looked at <a href="https://github.com/nestjsx/nest-access-control" rel="nofollow noreferrer">nest-access-control</a> but can't figure out if it can be used for this.</p>