diff --git a/server/internal/auth/middleware.go b/server/internal/auth/middleware.go
index 40e2c9d..dfd2ec1 100644
--- a/server/internal/auth/middleware.go
+++ b/server/internal/auth/middleware.go
@@ -14,6 +14,27 @@ func GetSessionFromContext(c *gin.Context) *Session {
 	return sess
 }
 
+func OrgID(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.OrgID
+	}
+	return ""
+}
+
+func Role(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.Role
+	}
+	return ""
+}
+
+func UserID(c *gin.Context) string {
+	if s := GetSessionFromContext(c); s != nil {
+		return s.UserID
+	}
+	return ""
+}
+
 func Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		if !authEnabled {
diff --git a/server/internal/auth/session.go b/server/internal/auth/session.go
index 65b48b7..969105a 100644
--- a/server/internal/auth/session.go
+++ b/server/internal/auth/session.go
@@ -17,6 +17,8 @@ const statePrefix = "km:state:"
 
 type Session struct {
 	UserID string `json:"user_id"`
+	OrgID  string `json:"org_id"`
+	Role   string `json:"role"`
 	Email  string `json:"email"`
 	Name   string `json:"name"`
 }