The docs reads like it's enough to have roles without assigning users to organizations. Morover, AuthKit allows a user to log in without any organization (perhaps correcly, for actions and business logic to then assign something to the user).
However, even with organization_id the flow is... inscrutable:
>> REQUEST >>