Account

A person signs in by giving their email address and opening the link that arrives. There is no password anywhere in the product.

A sign-in link works once, and is stored only as a hash.

A sign-in link expires fifteen minutes after it is issued. A stale or already-used one lands back on the sign-in form saying to ask for another.

Asking for another link does not kill the one already in the inbox. Each stands until it is used or runs out.

The emailed link points at the address people reach the Hub on, so it opens from the phone or laptop that received it.

Where the Hub's address follows the browser (no fixed public address, a list of its own addresses), a sign-in link or redirect is only ever built on one of those addresses, over http or https. A request naming any other host, a scheme that is not exactly http or https, or more than one host or scheme is refused (421) and nothing is sent. With a fixed public address, the request's host is never used.

e.g. Host: localhost:3000 with x-forwarded-proto: https://evil.example/ → refused; no link names evil.example.

e.g. x-forwarded-host: localhost:3000, evil.example → refused.

Where a deployment has no mail relay, the "check your email" page says the link went to the Hub's log and nothing was sent.

Whether an address may sign in is decided when the link is asked for and again when it is followed. Access taken away in between cannot be used.

Where a Google login is set up, it stands beside the link form and signs the same person in. Where it is not, the button is absent.

A person who has been signing in by link and then signs in with Google on the same address reaches the same account, never a lock-out. Only Google joins this way, because Google proves the address.

An address is the same person however it is capitalised, with the same memberships.

e.g. Ana@ after ana@ → one account, not a second with an empty fleet.

A linked outside login records only which provider it was and who the person is there. The tokens it hands over are dropped.

A session lasts eight hours and then asks for a fresh link.

A session carries, from the moment it starts, the person's address and name, every tenant they belong to with their role there, and whether they run the platform.

Sign out sits in the rail under the person's own address. Using it ends the session, and the next page asks for a link again.

Every page is behind one gate. Only the sign-in, check-your-email and no-access pages and the health checks answer without a session.

A signed-out browser asking for a page is sent to the sign-in form carrying where it was going, and lands there once it signs in.

e.g. a bookmark of a tenant's Members screen → sign in, then that screen.

A signed-out request to a machine address is refused in plain words rather than sent to the sign-in page, so a program sees a failure.

The place carried through sign-in can only be a page of this Hub.

e.g. a link back to another site → ignored; the person lands on their own front door.

Having an account is not having access: a person sees exactly their memberships, and being known to an agent in Slack never creates a login.

Signing in lands a person on the first tenant they belong to, in a fixed order; an operator with no tenant on the Admin screen; an account with no membership on the no-access page.

One account per address, held in one place, however it first appears — invited (MEMBER-INVITE-IS-INSTANT), signed in, or met through an agent. A second attempt updates that person, never making a twin.

An account's email is the identity everything else hangs off, and no edit can change it. Only the name and the confirmed mark are written again.

An operator is a standing on the account itself rather than a membership: it runs the platform and reaches every tenant (TENANT-OPERATOR-SEES-ALL).

The platform's owner list is the only way in before any membership exists: an address on it becomes an operator the first time it signs in, account and all.

e.g. an address on the list signs in to an empty platform → operator, and owner everywhere (MEMBER-OPERATOR-OWNS-ALL).

e.g. an address not on the list and invited nowhere → refused, and no account is made.

A person is referred to everywhere by their account's id — by agents, memberships, the organization and credentials — never by a Slack or other chat id. A chat id only says which account a message is from.

A person's id on a chat surface — a Slack user in a workspace, a Teams or Discord user — is a chat id of their account. Every agent that meets it meets that account; no agent keeps its own copy of it.

e.g. Ben writes to Nova and to Orion → one account, one Slack chat id, known to both by her account id.

The first time someone writes and the surface gives their email, the chat id is attached to the account with that email, made if new (ACCOUNT-EXISTS-ONCE). It gives no membership and no Hub access (ACCOUNT-SIGN-IN-NOT-ACCESS), and a chat id is never a way to sign in.

When the surface withholds the email, no account is made or guessed from a name. The platform's notice shows the person their own chat id and tells them to ask the agent's manager or an admin to allow them.

e.g. a Slack Connect guest writes to Nova → "I can't tell who you are yet. Ask Ben or an Northwind admin to allow Slack id U0XXXX." — no turn, no account.

A person's chat id is shown on each agent's People tab, as a detail of the person chosen (PEOPLE-ONE-PICKER); never a token. Their own profile shows it too once there is one (ORG-PROFILE-PAGES).