User

User is the aggregate root of this application? I don't know for sure if this is correct. It seems to be the root of all relations. However, memberships would have been linked to the user if this was correct. As they are linked to the accounts this seems a design violation?

It seems like user is some kind of center entity in this service.

Accounts

In this application accounts are an abstraction between users and login provider. And account will link a user to an organisation via memberships.

Memberships

Memberships are connecting an account to an organization. Organizations are managed by the organizations microservice

Roles

A fine graned layer of roles is used to control authorization on different levels

• employee, an account specific set of roles for true employees
• membership, an account specific set of roles for a membership of an organisation