backend/src/modules/auth/auth.controller.ts

@@ -126,7 +126,11 @@ export class AuthController {
   @ApiBearerAuth('JWT-auth')
   @ApiOperation({ summary: 'Create organization for current user' })
   async createOrganization(@Req() req, @Body() dto: CreateOrganizationDto) {
-    return this.authService.createOrganization(req.user.id, dto);
+    return this.authService.createOrganization(
+      req.user.id,
+      req.user.organizationId,
+      dto,
+    );
   }
 
   // =========================

backend/src/modules/auth/auth.service.ts

@@ -4,6 +4,7 @@ import {
   UnauthorizedException,
   BadRequestException,
   ConflictException,
+  ForbiddenException,
   InternalServerErrorException
 } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
@@ -270,7 +271,11 @@ export class AuthService {
     return this.login({ email, password } as any, validatedUser);
   }
 
-  async createOrganization(userId: string, dto: CreateOrganizationDto) {
+  async createOrganization(
+    userId: string,
+    currentOrganizationId: string | undefined,
+    dto: CreateOrganizationDto,
+  ) {
     const owner = await this.prisma.user.findUnique({
       where: { id: userId },
       select: { id: true },
@@ -280,6 +285,28 @@ export class AuthService {
       throw new UnauthorizedException('User not found');
     }
 
+    if (!currentOrganizationId) {
+      throw new ForbiddenException(
+        'Select an organization before creating a new one.',
+      );
+    }
+
+    const currentMembership = await this.prisma.membership.findUnique({
+      where: {
+        userId_organizationId: {
+          userId,
+          organizationId: currentOrganizationId,
+        },
+      },
+      select: { isOwner: true },
+    });
+
+    if (!currentMembership?.isOwner) {
+      throw new ForbiddenException(
+        'Only owners of the current organization can create new organizations.',
+      );
+    }
+
     const organization = await this.prisma.$transaction(async (tx) => {
       const createdOrganization = await tx.organization.create({
         data: {

frontend/src/components/shared/permissions.ts

@@ -16,6 +16,11 @@ export function hasPermission(org: Organization | null, permission: string): boo
   return Boolean(org.permissions?.includes(permission));
 }
 
+/** True when the user is owner of the currently selected organization. */
+export function canCreateOrganizationFromCurrentOrg(org: Organization | null): boolean {
+  return Boolean(org?.isOwner);
+}
+
 /** Sidebar / route guard: READ access to a tab */
 export function canViewTab(org: Organization | null, readPermission: string): boolean {
   return hasPermission(org, readPermission);

frontend/src/components/ui/organizations/OrganizationSelectorContent.tsx

@@ -1,13 +1,26 @@
 'use client';
 
-import { useState } from 'react';
+import { useMemo, useState } from 'react';
 import { useAuth } from '@/lib/hooks/useAuth';
+import { canCreateOrganizationFromCurrentOrg } from '@/components/shared/permissions';
 import { Building2, Beaker, Mail } from 'lucide-react';
 import { Input } from '@/components/ui/shared/Input';
 import { Button } from '@/components/ui/shared/Button';
 
 export function OrganizationSelectorContent() {
-  const { organizations, selectOrganization, createOrganization, isLoading, error, clearError } = useAuth();
+  const {
+    organizations,
+    currentOrganization,
+    selectOrganization,
+    createOrganization,
+    isLoading,
+    error,
+    clearError,
+  } = useAuth();
+  const canCreateOrganization = useMemo(
+    () => canCreateOrganizationFromCurrentOrg(currentOrganization),
+    [currentOrganization],
+  );
   const [isCreateOpen, setIsCreateOpen] = useState(false);
   const [organizationName, setOrganizationName] = useState('');
   const [organizationEmail, setOrganizationEmail] = useState('');
@@ -44,9 +57,12 @@ export function OrganizationSelectorContent() {
         <div>
           <h1 className="text-3xl font-semibold text-text-primary">Organizations</h1>
           <p className="text-text-secondary mt-2">
-            Select an organization to continue, or create a new one.
+            {canCreateOrganization
+              ? 'Select an organization to continue, or create a new one.'
+              : 'Select an organization to continue.'}
           </p>
         </div>
+        {canCreateOrganization && (
           <Button
             type="button"
             variant={isCreateOpen ? 'outline' : 'primary'}
@@ -57,9 +73,10 @@ export function OrganizationSelectorContent() {
           >
             {isCreateOpen ? 'Cancel' : 'Create Organization'}
           </Button>
+        )}
       </div>
 
-      {isCreateOpen && (
+      {canCreateOrganization && isCreateOpen && (
         <div className="surface-card p-6 space-y-4">
           <Input
             label="Organization name"
@@ -126,7 +143,11 @@ export function OrganizationSelectorContent() {
 
       {!organizations.length ? (
         <div className="surface-card p-8 text-center">
-          <p className="text-text-secondary">No organizations found. Create your first one to continue.</p>
+          <p className="text-text-secondary">
+            {canCreateOrganization
+              ? 'No organizations found. Create your first one to continue.'
+              : 'No organizations found. Ask an organization owner to invite you.'}
+          </p>
         </div>
       ) : (
         <div className="grid gap-4">