@@ -0,0 +1,12 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec/contracts): `IAuthService.verifyMcpAccessToken`'s verified result gains an optional `organizationId`, the organization the user's OAuth consent bound
+
+Clause-②: yes (widening)
+
+- **What changed.** The verified result of `verifyMcpAccessToken` (`@objectstack/spec/contracts`) is now `{ userId: string; scopes: string[]; clientId?: string; organizationId?: string }`. `organizationId` is the organization the user's OAuth consent bound (the user's current organization at the moment of consent), read from the access token's `organization_id` claim.
+- **Absent** when no consent bound one: a token minted before consents bound an organization. Absent means no organization, so only the user's global grants apply.
+- **A claim, not an authorization.** A caller vets it on every request by the rule that vets a session's active organization (`vetOrganizationClaim`, `@objectstack/core`). Once no current membership backs it, the principal resolves with no organization (global grants only: tenant reads come back empty and tenant writes are refused), never in another organization. The token acts in that one organization only: never the union of the user's organizations, and never the organization the user's browser session has selected now.
+- **Type only, and additive.** The member is optional, so an implementation that returns no `organizationId` still satisfies the contract, and nothing this package does at runtime changes. This package declares the member only: writing the claim at consent is the auth plugin's, and reading it into the OAuth session is the runtime's.
@@ -38,8 +38,8 @@ export interface IAuthService {
   /** Whether this deployment's auth gate is live. Optional. */
   isAuthGateActive?(): boolean;
 
-  /** Verify an OAuth 2.1 access token from the embedded AS (MCP surface). Optional. */
-  verifyMcpAccessToken?(token: string): Promise<{ userId: string; scopes: string[]; clientId?: string } | undefined>;
+  /** Verify an OAuth 2.1 access token from the embedded AS (MCP surface); the optional `organizationId` is the organization the user's OAuth consent bound, absent for a token minted before consents bound an organization. Optional. */
+  verifyMcpAccessToken?(token: string): Promise<{ userId: string; scopes: string[]; clientId?: string; organizationId?: string } | undefined>;
 
   /** The MCP resource identifier (RFC 8707 `resource` / token `aud`). Optional. */
   getMcpResourceUrl?(): string;
 
@@ -115,6 +115,27 @@ describe('Auth Service Contract', () => {
     expect(service.getMcpResourceUrl).toBeUndefined();
     expect(service.getMcpResourceMetadataUrl).toBeUndefined();
   });
+  // The verified MCP access-token result names the organization the user's
+  // OAuth consent bound, as an OPTIONAL member: a token minted before consents
+  // bound one verifies with none. The typed
+  // reads below are the pin; `check:test-typecheck` compiles this file.
+  it('should carry the consent-bound organization on a verified MCP access token, optionally', async () => {
+    const base: IAuthService = { handleRequest: async () => new Response('OK'), verify: async () => ({ success: true }) };
+    const bound: IAuthService = {
+      ...base,
+      verifyMcpAccessToken: async () => ({ userId: 'u1', scopes: ['data:read'], clientId: 'c1', organizationId: 'org_alpha' }),
+    };
+    const unbound: IAuthService = {
+      ...base,
+      verifyMcpAccessToken: async () => ({ userId: 'u1', scopes: ['data:read'], clientId: 'c1' }),
+    };
+
+    const boundOrganization: string | undefined = (await bound.verifyMcpAccessToken!('t'))?.organizationId;
+    const unboundOrganization: string | undefined = (await unbound.verifyMcpAccessToken!('t'))?.organizationId;
+    expect(boundOrganization).toBe('org_alpha');
+    expect(unboundOrganization).toBeUndefined();
+  });
+
   // [#23772] The principal-session mint is OPTIONAL: an auth service that
   // cannot mint a session keeps satisfying the contract unchanged, and a
   // consumer reads its absence as "no mint here", never as a failed mint.
 
@@ -294,7 +294,32 @@ export interface IAuthService {
      * [#4127 batch 4] Implemented by `AuthManager`; the execution-context
      * resolver has always called it through `any`.
      */
-    verifyMcpAccessToken?(token: string): Promise<{ userId: string; scopes: string[]; clientId?: string } | undefined>;
+    verifyMcpAccessToken?(token: string): Promise<{
+        userId: string;
+        scopes: string[];
+        clientId?: string;
+        /**
+         * The organization the user's OAuth consent bound (the consenting
+         * user's current organization at the moment of consent), read from
+         * the access token's `organization_id` claim.
+         *
+         * Absent when no consent bound one: a token minted before consents
+         * bound an organization. Absent means the principal resolves with no
+         * organization, so only its global grants apply.
+         *
+         * A claim, not an authorization. The caller vets it on every request
+         * by the rule that vets a session's active organization
+         * (`vetOrganizationClaim`, `@objectstack/core`): once no current
+         * membership backs it, the principal resolves with no organization
+         * (global grants only, so tenant reads come back empty and tenant
+         * writes are refused), never in another one. The token acts in this
+         * one organization: ⛔ never the union of the user's organizations,
+         * and ⛔ never the organization the user's browser session has
+         * selected now. Under ADR-0090 D10 it is the organization the
+         * delegator's grants are resolved in.
+         */
+        organizationId?: string;
+    } | undefined>;
 
     /**
      * [#23772] Mint a short-lived session for the requesting user's OWN