Anggota

Siapa yang boleh memakai konsol dan apa yang boleh dilakukan: anggota dengan peran mereka di satu tab, peran itu sendiri di tab lain. Undangan hanya untuk orang yang disebut namanya, dan pemilik terakhir tidak bisa menghapus dirinya sendiri.

Users

Everyone in the organisation, with their roles and when they joined. Inviting sends an invitation that belongs to the address it names: redeeming it requires signing in as that person, and a token with no address to check is refused rather than waved through. Invitations still pending sit in their own band above the grid, resendable and revocable. Removing a member is guarded by the last-owner rule: an organisation can never be left with nobody who can administer it.

Roles

Four system roles ship with every organisation: owner, admin, member and operator. A system role opens read-only, listing every permission it carries, so what a role grants is a fact to inspect rather than a sentence to trust. Custom roles are authored here too, picking exactly the product permissions they should carry, and what a role may delegate follows the delegation rule: an owner can hand on everything, an admin everything except billing and role authoring, and the other roles nothing.

Where this meets the API

On the wire the roster is the organisationMembers query and the caller's own permissions are myGrants (GraphQL reference); roles and invitations are administered through the shared accounts service the whole platform signs in with, which is why a member here is the same identity that holds API credentials elsewhere.