How to manage employee access
Access is a state that changes throughout employment, not a one-time invitation on day one.
Invitations must be constrained
An invite token is cryptographically random, stored only as a hash, expires, and is single-use. Resend issues a new token and invalidates the prior one.
The email provider receives a backend-generated link. Its API key is never sent to web or native clients.
Roles change with responsibility
Owner, Administrator, Manager, and Employee cannot differ only by label. The backend checks capabilities for every administrative action.
A manager may see a department when policy allows, but does not automatically gain billing or emergency-wipe rights.
Offboarding closes every active route
Membership removal includes session revocation, device policy, realtime disconnect, and future key rotation.
Audit records the action and result without message plaintext, passwords, or bearer tokens.
This guide explains verifiable product principles and is not legal advice.