Team and invitations

Four roles, strictly ordered. Each includes everything below it, and a member holds one for the workspace as a whole.

A per-project membership can raise or lower this for one project - see Projects. The full matrix is in Role capabilities.

Team → Invite. Enter one or more email addresses - up to ten at a time - and pick a role. Each recipient gets an email with a link.

An invitation is an offer. It grants nothing until it is accepted, expires after seven days, and can be revoked before then.

Only a hash of the token is stored; the link in the email is the only copy, so a database compromise does not yield working invitations.

Pending invitations are listed on the team page with who sent each one and when it expires.

• Resend issues a fresh token and revokes the previous one. Two live tokens for one seat makes revoking ambiguous exactly when it is urgent.

• Revoke withdraws the offer. The link stops working immediately.

• Declining and revoking are recorded separately - "they said no" and "we withdrew it" are different facts and you will want to tell them apart.

Removing a member ends their membership of this workspace only. Their account, their own workspaces, and their memberships elsewhere are untouched.

What they created stays. Secrets, targets, and runbooks belong to the project, not the person; audit entries naming them remain, because an audit log you can erase by removing someone is not an audit log.

Free and Pro are single-seat plans and do not include team management. Team includes five seats; Enterprise is unlimited.

A seat is consumed by an accepted membership. A pending invitation does not consume one until it is accepted, so inviting six people to a five-seat workspace succeeds until the sixth tries to join.