Teammates and roles

Every member sees every record in the workspace. Roles decide who may change things, and the server enforces the matrix on every write route; the portal only hides what a role cannot do.

The matrix

Permission	Owner	Admin	Engineer	Auditor	Ingest key
members:manage invite, change roles, remove	yes	yes
keys:manage ingest keys	yes	yes	yes
sources:manage connectors	yes	yes	yes
custody:checkpoint checkpoint now	yes	yes	yes
notices:manage draft, approve, send, withdraw, reconsider	yes	yes
retention:manage policy and legal holds	yes	yes
custody:manage take custody	yes
records:write ingest and upload originals	yes	yes	yes		yes

An auditor’s every request that would change state is refused with 403 read_only_role before any route runs. GET /v1/auth/me returns the caller’s role, permissions and memberships.

Who may grant what

Owners grant admin, engineer or auditor. Admins grant engineer or auditor, never admin, so a compromised admin account cannot multiply itself. Nobody grants owner; the owner is the person who created the workspace and cannot be changed or removed.

Invitations

1. An owner or admin invites an email with a role. Stratl emails a link containing a random 256-bit token; only its SHA-256 is stored. The link works for seven days and once, and a new invitation to the same address voids the previous link.
2. The recipient opens the link, sees the workspace and the role, and confirms the invited address with a one-time code. Accepting requires a session whose verified email is the invited address; any other session is refused with 403 invite_email_mismatch. A forwarded link is therefore useless to anyone who cannot read that mailbox.
3. Accepting creates the membership and makes the session act in that workspace.

Limits: 25 pending invitations per workspace, 20 sent per hour. Unknown, expired, revoked and used links are reported as such by the preview endpoint, which shows the workspace name, the role and a masked address and nothing else. Expired and revoked invitations are deleted a month later; accepted ones stay as the record of who invited whom.

Changes and departures

Nobody can change their own role or remove themselves. An admin cannot change or remove another admin. Removing a member takes effect on their next request; records, notices and keys they created stay, with their name on them. A person in several workspaces switches between them from the account menu; their role can differ per workspace.

Single sign-on and SCIM are not built.