Protect owner invitation authority

2026-09-04 00:30:29 -04:00
parent d54d6a4ad1
commit 3fe1547a5b
10 changed files with 143 additions and 16 deletions
@@ -12,6 +12,10 @@ expiring, single-use invitations. An invitation may carry one direct role and
 up to sixteen reviewed team memberships. Acceptance verifies that the
 authenticated user's normalized email matches and applies the membership,
 role, teams, consumption marker, and audit event in one transaction.
+When `OwnerRole` is configured, creating or revoking an invitation carrying
+that role additionally requires a current active direct owner inside the same
+SQLite transaction. A broad access-management permission may administer
+ordinary invitations but cannot create or cancel owner access.
 Applications own invitation pages, email or out-of-band delivery, active-source
 checks before archival, and account recovery.