OR, perhaps a new concept is needed in FusionAuth -- "Organizations" if you will -- that allows for granting users with different permission sets inside the same Application.

You should feel free to open up a feature request here.

In my case, we have user accounts that can exist in, and have different permissions to, different tenant instances of the same application. I'm planning to work around this by using API to creating a new instance of the application from a sort of hard-coded template every time I create a tenant, and creating duplicates of users in the same fashion. But it's certainly awkward, I wish there were a way to share Applications and Users across tenants.

OR, perhaps a new concept is needed in FusionAuth -- "Organizations" if you will -- that allows for granting users with different permission sets inside the same Application.