organization-membership-security

What problem does it solve?

Managing membership across tenants securely is complex: you need strict authorization on who can invite, promote, or remove members, and you must guard against last-owner loss, ensure a tamper-evident audit trail, and perform complete offboarding.

Core Features & Use Cases

• Membership data model with tenant_id, user_id, role, status, and an immutable audit log of changes.
• Role hierarchy enforcement and self-change prevention to prevent privilege escalation and accidental demotions.
• Last-owner protection to prevent tenants from becoming inaccessible.
• Atomic offboarding workflow that revokes sessions, API keys, invites, and reassigns resources as configured.
• Reversible suspension flow that blocks access while preserving data ownership.

Quick Start

Invite a member to a tenant with a specific role and confirm the action complies with the role hierarchy.