After validating the token, call user.GetOrgMemberInfo with the org ID from the request path and return 403 when it comes back nil. Never trust an org ID from the client alone: the membership check against the verified token is what makes the route org-scoped.

Context: Official docs (propelauth-go README): documents a gotcha that trips agents protecting org-scoped routes in Go. Validating the access token only proves the request came from a logged-in user; you must separately confirm membership in the target org with GetOrgMemberInfo on the user object. A nil result means 403: the user is real but not a member of that org. Agents that stop at token validation leak cross-org data.