Description
Member Invitations and Membership provide the complete path from inviting a person to governing their workspace presence. An authorized administrator chooses an email address and role, receives a copyable invite link, and can track the principal through active or suspended states. Before authentication, the invitation can be resolved to safe context; after authentication, acceptance binds the verified identity subject to the company-scoped principal rather than trusting a user-supplied identifier.
The membership record is the human principal itself, so role assignment, company isolation, and session hydration all reference one authority identity. Invite acceptance has a deliberately narrow bootstrap carve-out for a valid but not-yet-bound session, while ordinary membership mutations remain permission-gated. Owner invariants prevent removing or suspending the workspace’s last active human Owner.
Selling Points
- Turns onboarding into a clear invite-link workflow with an administrator-selected starting role.
- Binds membership to verified identity claims, reducing the risk of a crafted acceptance request joining the wrong account.
- Lets administrators remove or suspend access without deleting the historical actor identity used by audits.
- Protects the final human Owner from accidental lockout during membership changes.
- Exposes the workflow through API-backed surfaces, enabling approved operational automation as well as UI use.
User Story
A workspace administrator opens People & Agents, invites a new editor, and copies the generated link into a trusted channel. The recipient follows it, signs in, reviews the workspace context, and accepts. They arrive with the chosen Editor role, while the administrator sees an active human principal they can later suspend or reassign without losing accountability history.
Extension Surface
This capability is automatable. The shipped route family in packages/api/src/routes/access.ts supports invite creation, resolution, acceptance, and principal lifecycle operations, while packages/access/src/service.ts enforces the same rules for every caller. There is no external invite-provider plugin contract; optional delivery is injected internally, and the v1 workflow always retains the copyable-link path.
Capabilities & Limits
- Creates company-scoped invitations with a selected role and secure token.
- Resolves pre-authentication invitation context and binds acceptance to a verified identity.
- Supports principal suspension, removal, and role reassignment with owner invariants.
- Invitation delivery is operationally optional; copyable links are the reliable v1 mechanism.
- The feature does not provide cross-tenant staff-issued invitations through the Admin plane.
Implementation Map
packages/access/src/service.tspackages/api/src/routes/access.tsapps/web/src/modules/access/components/InviteCreationModal.tsxapps/web/src/modules/access/AcceptInvitePage.tsx