@@ -412,3 +412,45 @@ Email visibility is a role grant: `email: ["read"]` on a role controls whether i
 members see other members' emails. `getContext` returns the caller's effective
 permissions as a nullable `permissions` map; routes in any plugin gate on it with
 `requirePermission(resource, action)`.
+
+## Idempotent org activation (composed flows)
+
+Create-or-reuse in two calls, no CONFLICT-recovery code:
+
+```ts
+const existing = await auth.getOrganization({ organizationSlug: slug }); // null when absent
+const org = existing ?? await auth.createOrganization({ name, slug, activate: false });
+```
+
+`activate: false` (mapped to better-auth's `keepCurrentActiveOrganization`) leaves the
+caller's active organization untouched — composed flows that must not disturb the
+session pass it; restore deterministically with `setActiveOrganization({ organizationId: null })`
+or re-set the intended org. The default (`activate: true`) preserves better-auth's
+create-switches-active behavior. `checkSlug` remains the typed existence probe when
+you only need "is this slug taken".
+
+## Abuse-control primitives (levers, not policy)
+
+The plugin ships no admission policy (#857 — policy is the app's job); it ships the levers:
+
+**Rate limits** — configure per operation in `variables.abuseControl.rateLimits`
+(`createOrganization`, `createOnboardingCode`, `redeemOnboardingCode`; each
+`{ window, max }` in seconds, keyed per caller). Limited calls fail with the
+declared `RATE_LIMITED` error carrying `retryAfterSeconds` and `limitType: "requests"`:
+
+```jsonc
+"abuseControl": {
+  "rateLimits": {
+    "createOrganization": { "window": 3600, "max": 3 }
+  }
+}
+```
+
+The limiter is in-memory per plugin instance — multi-instance hosts share no
+counters. Absent rules mean unlimited.
+
+**Gate signals** — already resolved in the request context; the intended inputs for
+app-side admission decisions: `user.isAnonymous` (anonymous-provisioned accounts),
+`user.emailVerified`, account age (`user.createdAt` vs now), and NEAR linkage
+(`near.hasNearAccount` / `near.primaryAccountId`). Compose them in your own oRPC
+middleware before the auth call — no plugin default policy exists.
@@ -51,11 +51,23 @@ export const organizationRoutes = {
         slug: z.string(),
         logo: z.string().optional(),
         metadata: z.record(z.string(), z.unknown()).optional(),
+        activate: z.boolean().optional(),
       }),
     )
     .output(organizationInfoSchema.extend({ createdAt: z.date() }))
     .errors(Errors),
 
+  getOrganization: oc
+    .route({ method: "GET", path: "/v1/auth/organizations/get" })
+    .input(
+      z.object({
+        organizationId: z.string().optional(),
+        organizationSlug: z.string().optional(),
+      }),
+    )
+    .output(organizationInfoSchema.nullable())
+    .errors(Errors),
+
   setActiveOrganization: oc
     .route({ method: "POST", path: "/v1/auth/organizations/set-active" })
     .input(z.object({ organizationId: z.string().nullable() }))
 
@@ -48,6 +48,19 @@ export function createOrganizationHandlers(
         return yield* mapDomainError(organizations.getOrganizationById(input.organizationId));
       }),
 
+    getOrganization: builder.getOrganization.use(requireAuth).effect(function* ({
+      input,
+      context,
+    }) {
+      const organizations = yield* OrganizationsService;
+      return yield* mapDomainError(
+        organizations.getOrganization(createHeaders(context.reqHeaders), {
+          organizationId: input?.organizationId,
+          organizationSlug: input?.organizationSlug,
+        }),
+      );
+    }),
+
     createOrganization: builder.createOrganization.use(requireAuth).effect(function* ({
       input,
       context,
 
@@ -154,7 +154,7 @@ export const buildOnboardingService = ({
       const eventId = input.eventId?.trim() || null;
       const eventName = input.eventName?.trim() || null;
       const maxUses = input.maxUses ?? DEFAULT_MAX_USES;
-      const standing = maxUses === 0 && input.expiresAt === null;
+      const isStanding = maxUses === 0 && input.expiresAt === null;
       const nowMs = yield* Clock.currentTimeMillis;
       const now = dateFromMillis(nowMs);
       const expiresAt = input.expiresAt === null ? null : resolveExpiry(input.expiresAt, nowMs);
@@ -164,10 +164,11 @@ export const buildOnboardingService = ({
         });
       }
 
-      if (standing) {
+      if (isStanding) {
         const existing = yield* Effect.promise(() => findStandingCode(db, organizationId, eventId));
-        if (existing?.encryptedCode) {
-          const code = yield* Effect.promise(() => cipher.decrypt(existing.encryptedCode!));
+        const encrypted = existing?.encryptedCode ?? null;
+        if (existing !== null && encrypted !== null) {
+          const code = yield* Effect.promise(() => cipher.decrypt(encrypted));
           return { ...toOnboardingSummary(existing), code };
         }
       }
@@ -177,28 +178,21 @@ export const buildOnboardingService = ({
       );
       const code = generateCode();
       const encryptedCode = yield* Effect.promise(() => cipher.encrypt(code));
-      const [row] = yield* attemptDb(() =>
-        db
-          .insert(schema.onboardingCode)
-          .values({
-            id: crypto.randomUUID(),
-            codeHash: hashCode(code),
-            encryptedCode,
-            organizationId,
-            eventId,
-            eventName,
-            teamId,
-            role: "member",
-            maxUses,
-            usedCount: 0,
-            expiresAt,
-            createdBy: userId,
-            createdAt: now,
-            updatedAt: now,
-          })
-          .returning(),
+      const row = yield* attemptDb(() =>
+        insertOnboardingCode(db, {
+          codeHash: hashCode(code),
+          encryptedCode,
+          organizationId,
+          eventId,
+          eventName,
+          teamId,
+          maxUses,
+          expiresAt,
+          createdBy: userId,
+          now,
+        }),
       );
-      if (!row) {
+      if (row === null) {
         return yield* new CodeCreateFailed({ message: "Failed to create code" });
       }
 
@@ -248,28 +242,21 @@ export const buildOnboardingService = ({
         );
         const code = generateCode();
         const encryptedCode = yield* Effect.promise(() => cipher.encrypt(code));
-        const [row] = yield* attemptDb(() =>
-          db
-            .insert(schema.onboardingCode)
-            .values({
-              id: crypto.randomUUID(),
-              codeHash: hashCode(code),
-              encryptedCode,
-              organizationId,
-              eventId,
-              eventName: null,
-              teamId,
-              role: "member",
-              maxUses: 0,
-              usedCount: 0,
-              expiresAt: null,
-              createdBy: userId,
-              createdAt: now,
-              updatedAt: now,
-            })
-            .returning(),
+        const row = yield* attemptDb(() =>
+          insertOnboardingCode(db, {
+            codeHash: hashCode(code),
+            encryptedCode,
+            organizationId,
+            eventId,
+            eventName: null,
+            teamId,
+            maxUses: 0,
+            expiresAt: null,
+            createdBy: userId,
+            now,
+          }),
         );
-        if (!row) {
+        if (row === null) {
           return yield* new CodeCreateFailed({ message: "Failed to rotate standing code" });
         }
         return { ...toOnboardingSummary(row), code };
@@ -701,6 +688,43 @@ export const buildOnboardingService = ({
     }),
   });
 
+async function insertOnboardingCode(
+  db: Db,
+  input: {
+    codeHash: string;
+    encryptedCode: string;
+    organizationId: string;
+    eventId: string | null;
+    eventName: string | null;
+    teamId: string;
+    maxUses: number;
+    expiresAt: Date | null;
+    createdBy: string;
+    now: Date;
+  },
+) {
+  const [row] = await db
+    .insert(schema.onboardingCode)
+    .values({
+      id: crypto.randomUUID(),
+      codeHash: input.codeHash,
+      encryptedCode: input.encryptedCode,
+      organizationId: input.organizationId,
+      eventId: input.eventId,
+      eventName: input.eventName,
+      teamId: input.teamId,
+      role: "member",
+      maxUses: input.maxUses,
+      usedCount: 0,
+      expiresAt: input.expiresAt,
+      createdBy: input.createdBy,
+      createdAt: input.now,
+      updatedAt: input.now,
+    })
+    .returning();
+  return row ?? null;
+}
+
 async function findStandingCode(db: Db, organizationId: string, eventId: string | null) {
   const [row] = await db
     .select()
 
@@ -41,8 +41,13 @@ export class OrganizationsService extends Context.Service<
         slug: string;
         logo?: string | null;
         metadata?: Record<string, unknown>;
+        activate?: boolean;
       },
     ) => Effect.Effect<InferOutput<"createOrganization">, AuthFailure>;
+    getOrganization: (
+      headers: Headers,
+      input: { organizationId?: string; organizationSlug?: string },
+    ) => Effect.Effect<InferOutput<"getOrganization">, AuthFailure>;
     setActiveOrganization: (
       headers: Headers,
       organizationId: string | null,
@@ -192,6 +197,7 @@ export const buildOrganizationsService = ({ auth, db }: { auth: Auth; db: Db })
         slug: string;
         logo?: string | null;
         metadata?: Record<string, unknown>;
+        activate?: boolean;
       },
     ) =>
       attemptAuth(() =>
@@ -202,6 +208,7 @@ export const buildOrganizationsService = ({ auth, db }: { auth: Auth; db: Db })
             slug: input.slug,
             logo: input.logo,
             metadata: input.metadata,
+            keepCurrentActiveOrganization: input.activate === false,
           },
         }),
       ).pipe(
@@ -211,6 +218,25 @@ export const buildOrganizationsService = ({ auth, db }: { auth: Auth; db: Db })
         })),
       ),
 
+    getOrganization: (
+      headers: Headers,
+      input: { organizationId?: string; organizationSlug?: string },
+    ) =>
+      attemptAuth(() =>
+        auth.api.getOrganization({
+          headers,
+          query: { organizationId: input.organizationId, organizationSlug: input.organizationSlug },
+        }),
+      ).pipe(
+        Effect.catchTag("AuthApiError", (error) => {
+          if (error.code === "BAD_REQUEST" && error.message === "Organization not found") {
+            return Effect.succeed(null);
+          }
+          return Effect.fail(error);
+        }),
+        Effect.map((result: any) => (result ? toOrganizationInfo(result) : null)),
+      ),
+
     setActiveOrganization: (headers: Headers, organizationId: string | null) =>
       attemptAuth(() =>
         auth.api.setActiveOrganization({
 
@@ -56,6 +56,6 @@ describe("credential-less in-process client (the #860 repro)", () => {
       context: { reqHeaders: user.reqHeaders },
     });
 
-    expect(Array.isArray(organizations)).toBe(true);
+    expect(organizations.length).toBeGreaterThan(0);
   });
 });
@@ -1,4 +1,4 @@
-import { eq } from "drizzle-orm";
+import { desc, eq } from "drizzle-orm";
 import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 import * as schema from "../../src/db/schema";
 import {
@@ -364,4 +364,72 @@ describe("organization handlers", () => {
       expect(result.daoAccountId).toBeNull();
     });
   });
+
+  describe("getOrganization", () => {
+    it("returns lightweight org info by slug and null for unknown", async () => {
+      const user = await createTestUser(services.services);
+      const org = await createTestOrg(services.services, user.userId, {
+        name: "Slug Org",
+        slug: `slug-org-${crypto.randomUUID().slice(0, 8)}`,
+      });
+      const handlers = createTestHandlers(services.services);
+
+      const found = await handlers.organizations.getOrganization({
+        input: { organizationSlug: org.slug },
+        context: { reqHeaders: user.reqHeaders },
+      });
+      expect(found?.id).toBe(org.id);
+      expect(found?.slug).toBe(org.slug);
+
+      const missing = await handlers.organizations.getOrganization({
+        input: { organizationSlug: `nope-${crypto.randomUUID().slice(0, 8)}` },
+        context: { reqHeaders: user.reqHeaders },
+      });
+      expect(missing).toBeNull();
+    });
+  });
+
+  describe("createOrganization activate semantics", () => {
+    it("defaults to switching the active organization; activate:false keeps it", async () => {
+      const user = await createTestUser(services.services);
+      const first = await createTestOrg(services.services, user.userId, {
+        slug: `act-a-${crypto.randomUUID().slice(0, 8)}`,
+      });
+      const handlers = createTestHandlers(services.services);
+
+      await handlers.organizations.setActiveOrganization({
+        input: { organizationId: first.id },
+        context: { reqHeaders: user.reqHeaders },
+      });
+
+      await handlers.organizations.createOrganization({
+        input: {
+          name: "Side Org",
+          slug: `act-b-${crypto.randomUUID().slice(0, 8)}`,
+          activate: false,
+        },
+        context: { reqHeaders: user.reqHeaders },
+      });
+
+      const sessionAfterKeep = await services.services.db.query.session.findFirst({
+        where: eq(schema.session.userId, user.userId),
+        orderBy: (s) => desc(s.createdAt),
+      });
+      expect(sessionAfterKeep?.activeOrganizationId).toBe(first.id);
+
+      const switched = await handlers.organizations.createOrganization({
+        input: {
+          name: "Main Org",
+          slug: `act-c-${crypto.randomUUID().slice(0, 8)}`,
+        },
+        context: { reqHeaders: user.reqHeaders },
+      });
+
+      const sessionAfterSwitch = await services.services.db.query.session.findFirst({
+        where: eq(schema.session.userId, user.userId),
+        orderBy: (s) => desc(s.createdAt),
+      });
+      expect(sessionAfterSwitch?.activeOrganizationId).toBe(switched.id);
+    });
+  });
 });