How to bind client role + group to represent a unique "role" ? (app level multi-tenancy)

[VincentB99]

I finally found this which describes the exact same need as mine :

Single realm, multi-tenant, tenant scoped role setup advice

Dear Keycloakers, We are investigating Keycloak as a future IAM solution to replace an in-house developed one. we would love some input on best practices and get your thoughts on our proposed setup: Existing setup Our product lives on a few domains with multiple tenants, a tenant has their documents, and users have different roles to work with them. Documents belong to a tenant Users belong to a domain Domains have a default tenant Domains can have more than one tenant Users have a role on …

Seems not resolved though