01must proveConfirmed | Invitation creation, resend, withdrawal and direct activation require access-management authority within the addressed customer; unknown or outside-customer targets return not found without creating membership records. no proof recorded yet | permission | api, service | test |
02must proveConfirmed | Invitation creation requires a valid e-mail address and stores its canonical form; missing or invalid addresses create no person. no proof recorded yet | validation | service | test |
03must proveConfirmed | Existing active members are directed to role management, already-invited members to resend, and revoked members return through their existing account and history. no proof recorded yet | validation | service, database | test |
04must proveConfirmed | Creation commits the membership and invitation together before provisioning sign-in and sending mail; the response reports delivery status and reason without the raw token, and delivery failure preserves the committed records. no proof recorded yet | lifecycle | service | test |
05must proveConfirmed | Inviters can offer only unconditionally allowed permissions at the proposed scopes, cannot invite roles onto their own account and receive the failing keys and scopes when delegation is refused. no proof recorded yet | permission | service | test |
06must proveConfirmed | Offered assignments remain pending until acceptance; grants outside a console member’s customer or outside a portal member’s single workspace fail before membership creation. no proof recorded yet | invariant | service | test |
07must proveConfirmed | Resend replaces outstanding invitations with a fresh seven-day link for an invited membership; already-accepted members are refused and directed to password recovery. no proof recorded yet | lifecycle | service | test |
08must proveConfirmed | Withdrawing an invitation revokes membership so that the old link cannot activate the person or their pending roles. no proof recorded yet | lifecycle | service | test |
09Confirmed | The user list reports the newest invitation’s pending, expired, accepted or revoked state with send and delivery information and supports invited, expired and never-invited filters. | policy | api, service | test |
10must proveConfirmed | Direct activation requires an already-linked sign-in identity on a never-invited membership; a member with an invitation must accept it instead. no proof recorded yet | lifecycle | service | test |
11Confirmed | Workspace-scoped invitation and member-list operations can administer that workspace’s portal members, and the portal list excludes console memberships. | policy | api, service | test |
12must proveConfirmed | Invitation mail uses Rhythm’s sender and a first-name greeting, includes expiry when available and keeps the raw link token out of the subject; display-name escaping prevents header and markup injection. no proof recorded yet | validation | service | test |