Tenancy, Roles & Members

is a multi-tenant platform. Every brand workspace is a fully isolated tenant — products, identifiers, passports, audit records, API credentials, and billing state are partitioned by brand_id at the database level and enforced by Row-Level Security on every read and write.

Role Model

Roles are stored in a dedicated user_roles table, never on the user or profile record, and are scoped to a specific brand_id. Role checks reject NULL brand scope to prevent privilege escalation across tenants.

Custom roles and granular permission packs are configured in Settings → Roles.

Member Management

Workspace owners and admins manage members from Settings → Roles:

• Invite new members by email
• Assign or change roles
• Revoke access immediately
• Transfer workspace ownership atomically (a workspace must always have exactly one owner)

Each member with at least one active role inside the workspace counts as a billable seat. Removing a member frees the seat immediately.

Platform Plane

A separate platform plane exists for tieback staff. Platform admins can:

• Investigate and support customer workspaces with full audit logging
• Manage carrier output profiles, market packs, and the field dictionary
• Operate the support console for incident response

Platform admin actions inside a tenant are logged distinctly from tenant-member actions and are subject to the no standing access policy — break-glass interventions require time-bound, cryptographically logged approvals.

Vendor Sandbox

External vendors (for example, contract manufacturers) can be granted access through a sandboxed vendor role. Vendors see only the products, batches, and assets explicitly shared with them and cannot enumerate the wider workspace.

Audit Log

Every role change, invitation, ownership transfer, and platform-staff intervention is recorded in the workspace audit log. See Audit Log.

Related Docs

• Audit Log
• Plans & Subscriptions
• Security Architecture