People, roles, and expiry

People contains Members, Invitations, and Roles tabs. Each appears only when the active organization role has the required permission.

Members and invitations

An owner or authorized people manager can add an existing registered account or invite someone to register/sign in with the invited email. Direct addition does not verify their email.

Invitations last 72 hours. Row actions support Copy link, Send email, Renew, and Revoke. Renew rotates the link; Copy and Send do not extend expiry. Sending requires configured Brevo delivery. Accepted membership can initially have no UserTypes and remain access-pending.

Roles

Assign UserTypes to an existing active membership. Only owners may assign the built-in Admin or permission-bearing groups and change privileged memberships. Delegated role managers can assign ordinary UserTypes and remove ordinary memberships.

Owner is a protected system role. Admin is a protected built-in UserType; its name, key, and definition cannot be edited/deleted, but owners can configure its permissions.

Expiry

In Owner mode, click Access expires on a non-owner member. Choose Never or a local date/time. The editor labels the browser timezone and stores a UTC instant.

Expiry blocks access on each organization API request. It preserves membership, role assignments, grants, and content. Owners can renew access without reassigning roles. Expired organizations disappear from that member's available membership list but remain visible to their owner for renewal.

Removing a membership is different from letting it expire. Readding a removed member clears previous UserTypes and individual grants; expired memberships retain them until renewed. Owner access cannot expire.

Adding an existing account accepts a syntactically valid email and returns the same acknowledgement whether or not an eligible account exists. Only existing active accounts are added; no account or invitation is created by this action. The authorized Members list still reflects successful additions. Access expiry opens a dedicated editor; choosing a specific date/time reveals a native calendar input in the browser’s local timezone.