Where do you configure users so that they cannot access resources that belong to other organizations?

Where do you configure users so that they cannot access resources that belong to other
organizations?

A.
roles

B.
domain separation