Workspace & invitations
Use company access links, approved membership and scoped sessions.
Company workspace links
The company slug resolves institution context through /api/auth/company/{slug}. Begin sign-in through its /start action and configured identity provider. Access derives from workspace and membership records, not a caller-controlled institution field.
Invitation lifecycle
Administrators create, inspect, cancel and reissue invitations using required versions and reasons. Pending delivery, sent delivery and accepted membership are distinct. An invitation record alone does not prove email delivery.
Roles and revocation
Inspect roles and permissions, enforce required MFA and audit membership changes. Sign-in and transaction approval are separate controls. Suspended membership and revoked checker authority affect subsequent authorization.