Org members + roles

Three org roles: Owner, Admin, Member. What each role can do, how invitations bind to users, and how to transfer ownership.

An organization has three roles, stored on the org_members join row:

Each org has exactly one Owner at a time, any number of Admins, and any number of Members.

How roles map to document access

The permissions resolver treats org roles specially for content inside the org’s libraries:

This is the least-privilege model — new Members start with no access, gain it through explicit grants. The opposite would be “everyone sees everything by default,” which gets messy fast.

Inviting members

Org Owners and Admins invite new members:

1. Org page → Members section → Invite
2. Enter the recipient’s email
3. Pick the role they’ll have after they accept (Admin or Member — Owner can’t be granted via invite)
4. Send

The recipient receives an email with a token-bearing link. When they click it and sign in (or sign up), they’re added to org_members with the chosen role.

The invite is stored in invites with target_type = 'org' and org_role set. It defaults to a 14-day expiry if unaccepted.

Changing a member’s role

Org Owners can change any role (including promoting another member to Owner or demoting themselves — but ownership transfer is a separate flow, see below).

Org Admins can change Member → Admin or Member → Admin and vice versa, but cannot create or remove Owners.

Members can’t change roles at all.

Removing a member

Org Owners and Admins can remove members from the org. Removal:

• Deletes the org_members row
• Removes the user from all the org’s groups (cascade)
• Revokes their access to every org library and document
• Doesn’t delete the docs the user created — those stay in the org library, owned by the org

Owners can’t be removed without transferring ownership first.

Transferring ownership

The Owner role moves through a deliberate flow:

1. Owner opens Org settings → Transfer ownership
2. Pick the recipient (must be an existing Admin or Member of the org)
3. Confirm — the new user becomes Owner, the previous Owner becomes Admin

This is the only way Owner changes. There’s no automatic transfer.

Billing implications

Admins manage members, libraries, and content. The Owner is the only role with billing authority (add/remove seats, change plan, cancel subscription).

Audit log

Every membership change (role updates, additions, removals, ownership transfers) is recorded in the audit log. The actor, target, and timestamp are all preserved.

Leaving an org as a member

Members can leave their own org from the org page (the kebab on their own row → Leave organization). They keep their personal library and any docs they own elsewhere; they lose access to the org’s libraries immediately.

Admins must be demoted to Member by the Owner before leaving (or they can demote themselves first). The Owner must transfer ownership before leaving.

What’s not in v1