In a multi-organization architecture, tokens should be reissued after an organization switch, and the backend should also verify that the organization identifier in the token is consistent with the request context to avoid cross-organization permission leakage.