5.3Security & access
Right people. Right access.
Keep your office workspace separate. Clearly define team permissions and resident access.
See how it worksAccess starts with a real relationship.
Office access
Protected settings & resident access
Workspace membership
The active workspace is checked against the signed-in user’s memberships. Owner, admin and member roles remain visible in the team list.
A role is more than a label.
Team actions check who is signed in and whether their role is allowed to act. Members do not get the same invitation controls as owners and admins.
Office branding has a separate boundary: the workspace subscriber controls the shared profile, even when colleagues help manage the team.
The product principle
Working together should not mean sharing the same access to everything.
A workspace you actually belong to.
The selected workspace is validated against membership. A workspace identifier alone is not an invitation to its records.
Keep pending invitations visible.
Review the recipient, intended role and invitation status. Cancel an outstanding invitation when plans change. Team management requires an eligible plan.
A code sent to a verified email.
Resident sign-in checks the registered primary email before creating a session. Expired codes and excessive attempts have explicit error states.
Access can change with the team.
Eligible owners and admins can remove a member. The organization owner cannot be removed through the member-removal action.
Clear boundaries for everyday work.
Office teams and residents use different entry points, with context appropriate to each person.