To add to this,
By 'org permissions', do you mean Admin rights within the org? That's not possible for a bot.
In general for admin rights, you would be best served to use an integration as Sandip described. You would then just need the Admin user to authorize that integration, so that it can assign the admin scopes to the access token (if a regular user authorizes an integration that has admin scopes, those will be ignored as the user doesn't have the necessary rights for them. Integration will still authorize, but will just assign the scopes that the user has rights/licenses to).
Also, for your example with memberships, note that a bot can check the memberships of a space/room they are part of. There is no restriction there. But if the bot wants to check messages in the space, it can only see the messages that it is @mentioned in a group space, can't see any other messages. It can see all messages in a direct space though.
