but in the case of a github-esque model (only where "accounts don't belong to a "tenant") where the organization would represent something more along the lines of a "special" kind of account (read: maybe the account is a member of the "github organizations" role) and anyone with an account (read: "member" role) can join another "sub" organzation (read: a unique org that would have "github organizations" as a parent for example). this would be a case where all "users" are accounts. I'm not 100% certain how github does it as i've not thought about it too deeply). I would imagine it would be at least something along the lines above.

wrt tenancy, you would need to flesh out how ory handles "organizations" and "project" (ids). That logic is sprinkled all over the code (lots and lots of hints in the openapi spec docs - i would read there first to get an idea of what they do)

the idea is, the "missing link" is the service that handles projects and organizations. but it can be inferred by looking at how kratos, etc uses those two values as discriminators and since the puzzle pieces arent included in the open source offering, cutting out the pieces and painting them yourself.