Roles
Each organization has exactly one owner — the person who created it. Owners differ from admins only in transfer and deletion rights; day-to-day administration (members, roles, invites, billing) is admin work, and there can be several admins.
Members are deliberately capable: publishing is a member right, because the people writing skills are rarely the people running the org. Members can leave at any time; an owner must transfer ownership first.
Removing a member (or a member leaving) revokes their devices for that organization.
Invite links
One shareable link onboards the team. It works in three modes:
Admin approval is always the base flow — the domain is a bypass for the common case. A pending membership carries no access at all: no catalog, no installs, nothing, until approved.
Practical details:
- The domain can be updated in place without changing the link.
- Rotating the link is a separate, deliberate action — the old link dies instantly.
- Joins are rate-limited to 50 per organization per day.