diff --git a/content/en/cloud/concepts/identity-and-security/organizations/_index.md b/content/en/cloud/concepts/identity-and-security/organizations/_index.md
index 30675b92073..e894ecaa44b 100755
--- a/content/en/cloud/concepts/identity-and-security/organizations/_index.md
+++ b/content/en/cloud/concepts/identity-and-security/organizations/_index.md
@@ -116,6 +116,22 @@ Assigning a new domain to an organization requires a Provider Admin. Organizatio
 
 The organization switcher lists only the organizations the user is a member of. Holders of View All Organizations can also select All Organizations. See [Navigating Organizations]({{< ref "cloud/guides/organizations/org-management/navigating-organizations.md" >}}).
 
+### Which organization a new connection joins
+
+Every connection you register belongs to one organization, which Layer5 Cloud assigns; you never choose it in the request. It is, in order:
+
+1. The organization selected for the session: the organization picker in the UI, or the `X-Current-Orgid` header a client sends.
+2. If none is selected, the only organization you belong to.
+3. If you belong to several, the only one of them you own.
+
+If none of these names exactly one organization, creating the connection is refused with `meshery_cloud-3632` (_Select an organization before registering a connection_). Select an organization and register again. Re-registering a connection you already have is never refused for this reason. A Meshery Server registers connections on your behalf without a header, so it uses your selected organization.
+
+Editing or re-registering a connection never moves it to another organization.
+
+Registering a connection you deleted brings it back, and it joins the organization it is registered in now, not the one it had before. Registering a connection ID that belongs to someone else, or to a connection of a different kind, is refused with `meshery_cloud-3633` (_The connection id is already in use_). The answer is the same whether or not that connection exists. Register without an ID, or with the ID of a connection you own.
+
+Connections created before October 2026 had no organization. Each was assigned the organization it could be traced to: the organization of the profiles it is linked to, else the organization of its environments, else its owner's only organization, else the only one of its owner's organizations the owner owns. Connections that could not be traced to exactly one organization were deleted, along with any credential no other connection used. Register them again to recreate them.
+
 ## Lifecycle
 
 [Organization Management]({{< ref "cloud/guides/organizations/org-management/_index.md" >}}) covers the procedures.
diff --git a/data/openapi.yml b/data/openapi.yml
index b184771c488..0553e426ce3 100644
--- a/data/openapi.yml
+++ b/data/openapi.yml
@@ -31992,8 +31992,15 @@ paths:
         it is refused with a `409` MeshKit error that names the reserved GitHub App connection identity.
 
 
-        Every connection belongs to exactly one organization. The server assigns `organizationId` from the session
-        (`X-Current-Orgid`, then the caller's selected organization) and does not accept it in the body.
+        Every connection created under this contract belongs to exactly one organization. The server assigns
+        `organizationId` and does not accept it in the body. In order, it uses the session organization
+        (`X-Current-Orgid`, then the caller's selected organization), then the only organization the caller belongs
+        to, then the only one of those the caller owns. If none of these names exactly one organization, registration
+        is refused with `400` and error `meshery_cloud-3632` (_Select an organization before registering a
+        connection_); select an organization and register again. Re-registering a connection that is still live is
+        never refused for this reason, and it keeps the organization it already has. Connections created before the
+        v1beta3 contract (October 2026) may carry no organization; they are the only exception to the one-organization
+        rule.
 
 
         Desktop registration uses this shared operation, but kind `desktop` is implemented by Cloud: a server that does
@@ -32022,8 +32029,10 @@ paths:
           required: false
           description: >
             Session organization. The server assigns `Connection.organizationId` from this header when it is present,
-            and from the caller's selected organization when it is absent. Kind `desktop` requires the header: a desktop
-            registration without it is refused with 400.
+            and from the caller's selected organization when it is absent. If neither names an organization, it falls
+            back to the caller's only organization, then to the only one of those the caller owns, and refuses with
+            `400` (`meshery_cloud-3632`) when none of these names exactly one. Kind `desktop` requires the header: a
+            desktop registration without it is refused with 400.
           schema:
             type: string
             format: uuid