The customer has its main organization; without one its workspace refuses the session.
The customer they last used: their default at the next login.
The role's keys in code-unit order; none without a role, for a refused internal role, or when not ACTIVE.
Holds an internal role, which grants nothing.
0 without a role, with an internal role that grants nothing, or when not ACTIVE.
One of the caller's own memberships, whichever customer it is in.