Team
Invite member
Invite is valid for the selected hours (auto-expiry). The user must already exist in Auth (email invites require Resend env).
Nothing here
Nothing here
RBAC matrix (roles × capabilities)
Defaults come from shared/auth/permissions; overrides are stored in platform_config.rbac_overrides.
| capability | owner | admin | manager | member | viewer |
|---|---|---|---|---|---|
| tenant.settings.edit | |||||
| tenant.delete | |||||
| billing.manage | |||||
| members.invite | |||||
| members.remove | |||||
| members.change_role | |||||
| mailbox.connect | |||||
| mailbox.disconnect | |||||
| messages.send | |||||
| campaigns.create | |||||
| campaigns.manage | |||||
| contacts.edit | |||||
| templates.edit | |||||
| documents.edit | |||||
| esign.request | |||||
| analytics.own.view | |||||
| analytics.team.view | |||||
| audit.view | |||||
| abuse.manage |
SSO (OIDC)
Nothing here
Passkeys (WebAuthn)
NOT RUN — set WEBAUTHN_RP_ID env to enable WebAuthn.
Remote logout revokes all observed session tokens (jti). Supabase JWT is stateless — only sessions seen by the middleware can be revoked.