# Membership

an account's place in one tenant, with a role. It is what lets a person see and change a tenant.

**Has:** one tenant · one account · a role (owner | admin | member). A tenant has many; an account has many (one per tenant). Deleting the tenant deletes them; deleting a membership leaves the account.

- A membership is created by an invitation from someone who may change the tenant. Signing in does not create one; being known to an agent in Slack does not create one.
  - e.g. a Slack user DMs an agent → they become an agent-account; the Members list does not change.
- A tenant never loses its last owner: demoting, removing, or re-inviting them at a lower role is refused.
  - e.g. one owner, re-invited as member → refused, still owner.
  - e.g. two owners, one steps down → allowed.
- One membership per tenant and account. Inviting the same email again changes the role.
- Inviting takes effect at once: the account is created if the email is new, and the person can sign in. There is no accept step.
- A malformed email or an unknown role is refused and nothing is written.
- Only an owner, an admin or an operator may invite, change a role or remove. A member sees the list with every control disabled.
- The Members page is one page shown in two places: a tenant's Members (that tenant's people) and the operator's Admin › Members (every tenant's people, each with the tenant they are in, a filter by tenant, and an invite that names the tenant). An operator adds anyone to any tenant, with any role, from either; what each row does is the same in both.
  - e.g. Ana in Admin › Members invites sam@ to Globex as owner, then to Initech as member → Sam appears twice, once per tenant; Globex's own Members shows him once.
- The right to change is checked again on every save, so a demotion stops a person's writes immediately. What their pages *show* follows at their next sign-in (at most 8 hours).
- A signed-in account opens only tenants it has a membership in; asking for another sends it to its own tenant, or to "no access" if it has none. Operators open every tenant.
- Removing a membership leaves the account and its other tenants untouched.
- An operator email (the platform's owner list) is made owner of every tenant when it signs in. This is the one membership not created by an invitation.
- Changing membership needs the Hub's service token. The token proves the caller is the Hub, not which person — the Hub must have checked [MEMBER-WHO-MAY-CHANGE](https://tonoman.com/docs/membership#member-who-may-change) first.
- An admin may give any role, including owner. *(under review:)*