The organisations the caller's own grants name.

The navigation surface: exactly the organisations in which the calling principal holds at least one grant, at org scope or below.

This is not listOrgs. That one enumerates every organisation on the instance and is operator work under instance-config, which the human-auth ADR makes MFA-mandatory; using it for navigation would put a second-factor wall in front of a sidebar. This one is a projection of the caller's own grant rows — disclosure of one's own grants is already presupposed by the grant views — so it needs no capability and can leak nothing the caller does not already hold.

A principal whose only grant is instance-scoped gets an EMPTY list, and that is correct rather than a gap. Instance scope inherits downward, so expanding it here would reproduce listOrgs without its gate. An operator who wants the whole instance asks for the whole instance, and steps up to do it.

Identity only — id and name. An organisation's metadata is operator-set and is read through getOrg, which authorizes.