This is slightly more complicated than simply changing the permissions methods: some of the places where permissions are checked, such as BulkAddProjectMembers, use the [AdminRequired] attribute, which simply checks the user role on the JWT. We have two options:

1. We could add an "org admin" role that goes on JWTs, which would then have to be deactivated any time a user is demoted from being an org admin (i.e. we'd have to force a logout on that user, otherwise he'd still have access permissions he should no longer have until the next time he logged out). Or
2. We could change these uses of [AdminRequired] to be method calls inside the function, rather than attributes. Method calls inside the function would have access to the project ID and could make database lookups, so they can enforce more subtle rules than "does the JWT have this flag?".

I'm going to go with option 2.