How to limit a App to an Organization and/or Role?

[cupcakearmy]

I would like to use logto for a organization. We have to user groups: employees & users.
Employees should be able to use some internal OICD apps depending on their role.
Users should only have access to the web app.
Is this possible? I could not find anything about scoping apps/clients to specific orgs or roles.