A contact can belong to more than one business relationship
A professional customer may contact a Norwegian supplier for one organisation while also representing another. A portal that identifies the person correctly can still open the wrong customer's records if the organisation context is implicit.
We can build a customer area for approved documents, service requests and defined account actions. The first scope establishes the individual, the represented organisation and the record they may access. Public organisation information is not evidence that a particular user is authorised to act.
Make authority visible where the action matters
Altinn's public access guidance provides a useful example of explicit organisation context and delegated powers. An independent customer portal must establish its own actual permission model; an Altinn role is not automatically permission inside a separate application.
Agree invitations, a change of contact and removal of access. Support staff need an approved investigation route that does not disclose another customer's information.
Test a person changing context
Use synthetic accounts and records for two organisations. Ask a reviewer to identify who they are acting for before viewing a document or submitting an action. Then remove one relationship and check what remains possible.
Information handling, retention and specialist requirements receive their proper review. The tool should make an authorised recurring task easier, rather than create a dashboard without a clear access boundary.
Reference: Altinn access packages. Describe the customer's recurring task.