Teams and roles

A User is the login identity. An Account is that User's membership on one Team and carries the role. A User can have Accounts on several Teams and selects one current team at a time.

The Team is both the tenant boundary and the Stripe customer. Customer deployments, connections, credentials, memberships, and billing state are scoped to it.

Roles

Every team has exactly one Owner.

• Owner can manage billing, rename the team, connect or replace Cloud and Forge credentials, invite and remove Admins or Members, transfer ownership, and perform all operational actions.
• Admin can install and resume products, attach applications, manage GitHub, adopt existing installs, claim providers, enable credential APIs, and invite or remove Members. An Admin cannot grant or remove Admin authority.
• Member has base read access to the team's ordinary product surfaces but cannot perform infrastructure or membership mutations.

No one can change or remove their own membership through the role controls. Ownership never moves through an ordinary role change.

Invitations

An Owner may invite an Admin or Member. An Admin may invite a Member. Sending an invitation creates only the invitation row; it does not create a User or membership before acceptance.

The emailed URL is signed and identifies the invitation. An anonymous recipient can register with the invited email and is then added to the inviting team at the invited role. Accepted invitations are idempotent, and pending invitations can be resent or revoked by someone with authority over their role.

Expired signed links reach a renewal page rather than a generic forbidden response. A recovery request is reviewed by a platform operator; recovery can reissue an invitation and, when required, assign ownership.

Transfer ownership

Only the current Owner can transfer ownership, and the recipient must already be a team member. The transfer promotes the recipient to Owner and moves the former Owner to Admin in one transaction, so the team is never left with zero or multiple Owners.

The transfer also updates the billing contact when the team already has a Stripe customer.

Agency teams

There is no separate Agency account type or billing organization. An agency is a User who owns several Teams.

An approved partner team carries a team allowance: the number of client Teams its Owner may add from it. Each Team added this way is given its own lifetime access to the Experimental apps at the moment it is created, and keeps it whatever later happens to the partner. Adding a Team does not merge memberships, credentials, infrastructure, or billing records between teams.