Product
Users, teams, roles, permissions, invitations, and organization access management.
Organization access is managed through users, teams, roles, and permissions. The product UI exposes fast hints for affordances, while writes and data reads are enforced by server actions, services, and RLS.
Organization users are signed-in users with a role inside the current organization. User pages support invitations and membership management for users with the required permissions.
Teams group existing organization users. Team records include name, slug, description, icon metadata, lifecycle state, and member assignments.
CentraKit has built-in system and organization roles, plus custom roles where supported by the UI. Permissions are typed in packages/identity/src/rbac/permissions.ts and mirrored into SQL seeds.
Organization roles can have per-organization permission overrides. Override precedence is explicit deny, explicit allow, role default, then deny.
Pending organization invitations live separately from organization_users, because an invitee may not have a user account yet. Accepting an invitation creates the membership row.