Spec the permission check for a multi-tenant SaaS

Your TypeScript SaaS serves many companies, called orgs, from one database. Authorization today is a scatter of if (user.isAdmin) checks in handlers. You are replacing them with one function, can(user, action, resource), and an agent will write it.

Write the spec you would hand the agent.

What you know:

• each user has a role per org (owner, admin, member or viewer), and a user can belong to several orgs
• resources are projects and documents, each with an orgId, and documents also have an ownerId
• product rules: viewers read; members read, create, and edit or delete their own documents; admins do anything in their org except delete it; owners do everything in their org
• users can be suspended, and support staff sometimes need to read a customer's org to work a ticket

Then, in a few sentences: what does "add a permissions check for roles" get dangerously wrong?