Keep login records separate from people

Use User for authentication

User owns authentication identity, account state, sessions, and the link to a profile. The session records the active tenant and the resolved permissions for each request.

• One user can belong to more than one tenant.
• Switching tenants checks active membership and rotates the session.
• Access requests can become users, memberships, and tenants after approval.

Use Profile for product identity

Profiles can represent people, organizations, bots, or public identities. They can exist before an account is created and can participate in typed, directional relationships.

Let the starter wire the common flow

Both starter paths include current session handling. The SaaS starter adds the finished onboarding, account, and tenant-management surfaces; the ground-up template keeps them visible as small examples you can change.