Inviting people to your workspace

A workspace holds projects, keyword lists and a subscription, and the people who can see them are its members. Inviting somebody is an owner’s action, and there is no charge for it: a plan counts projects and budgets, never people.

An invitation is not a credential

There is no token in an invitation and no link that signs anybody in. A row says that an address may join; proving you hold that address is sign-in’s job, and accepting is keyed on the invitation together with the address sign-in recorded for you. So forwarding the invitation to somebody else gives them nothing, and the invitation list itself grants access to nothing.

A consequence worth knowing: an account whose address this product does not actually know — which can happen when a provider declines to confirm one — matches no invitation at all. That is the state in which matching by address has to refuse.

Two roles

An owner may invite, withdraw an invitation and remove a member. Everybody may leave. The last owner can neither leave nor be removed, because a workspace nobody owns is a workspace nobody can administer.

Removal takes effect on the next request

Membership is re-checked on every request rather than at sign-in, so removing somebody takes effect on their next request even though their browser is still holding a session that names the workspace.

Several workspaces, one tab at a time

An account can belong to several workspaces, and the switcher moves between them. Opening a project belonging to another workspace switches to that workspace, which is worth knowing if you have two tabs open: a form drawn for one workspace acts on that workspace or on nothing at all, and says so rather than acting on whichever one the other tab moved you to.