Membership

A membership is created by an invitation from someone who may change the tenant. Signing in does not create one; being known to an agent in Slack does not create one.

e.g. a Slack user DMs an agent → they become an agent-account; the Members list does not change.

A tenant never loses its last owner: demoting, removing, or re-inviting them at a lower role is refused.

e.g. one owner, re-invited as member → refused, still owner.

e.g. two owners, one steps down → allowed.

One membership per tenant and account. Inviting the same email again changes the role.

Inviting takes effect at once: the account is created if the email is new, and the person can sign in. There is no accept step.

A malformed email or an unknown role is refused and nothing is written.

Only an owner, an admin or an operator may invite, change a role or remove. A member sees the list with every control disabled.

The Members page is one page shown in two places: a tenant's Members (that tenant's people) and the operator's Admin › Members (every tenant's people, each with the tenant they are in, a filter by tenant, and an invite that names the tenant). An operator adds anyone to any tenant, with any role, from either; what each row does is the same in both.

e.g. Ana in Admin › Members invites sam@ to Globex as owner, then to Initech as member → Sam appears twice, once per tenant; Globex's own Members shows him once.

The right to change is checked again on every save, so a demotion stops a person's writes immediately. What their pages show follows at their next sign-in (at most 8 hours).

A signed-in account opens only tenants it has a membership in; asking for another sends it to its own tenant, or to "no access" if it has none. Operators open every tenant.

Removing a membership leaves the account and its other tenants untouched.

An operator email (the platform's owner list) is made owner of every tenant when it signs in. This is the one membership not created by an invitation.

Changing membership needs the Hub's service token. The token proves the caller is the Hub, not which person — the Hub must have checked MEMBER-WHO-MAY-CHANGE first.

An admin may give any role, including owner. (under review:)