The folders this organization holds a role on, and so carries its members into.

The GRANTS the organization holds, NOT the folders it keeps. Those are two different lists and list_organization_domains above is the other one: a folder filed under the organization's own tenant is its property, while a row here is somebody else's folder that the organization was let into, and every member inherits it. Separate paths because conflating them would make "what does this organization own" and "what was this organization lent" the same question, and only the second one can be revoked by a stranger.

Direct grants only. An organization granted on finance also carries its members into payroll.finance, but that reach is derived from this row rather than written anywhere, so listing the descendants would present one grant as many and offer no way to revoke the copies.

Membership-gated at any organization role: this is a list of what the caller's own membership already gets them, so an outsider has no business reading it.