How do you design permissions for a multi-tenant SaaS product?

I’ve been thinking a lot recently while working on migrating the

Role and Permission System of our organization-based SaaS product to a more scalable authorization architecture.
Our product has multiple roles, different permissions, and different data scopes depending on the user and organization. As the system grows, simply adding more roles and if conditions across endpoints quickly becomes difficult to maintain.
I’m exploring how large-scale products approach data scoping, delegated permissions, and centralized authorization; so any custom roles can be created and assign any combination of permissions to them.

For those who have worked on authorization systems at scale:
What architecture or approach has worked best for you?
I’d especially love to hear about real-world lessons, common mistakes, or resources you’d recommend.