Skip to content

6.2.2.4 OrganizationAccessControlMembership

6.2.2.4.1 Purpose

Grants a user a role inside an Organization. A direct membership gives a user a role in the Organization they belong to; a delegated membership lets a member of another Organization act through a delegation. Memberships are the single place to check what a user can do, and where. They are never deleted: a membership that ends is revoked, so the question can also be answered for any date in the past.

6.2.2.4.2 Questions it answers

  • Which role does this user hold in this Organization, and who assigned it?
  • Does the user act directly or through a delegation?
  • Which memberships are revoked when a user leaves an Organization or a delegation ends?
  • Who could act in this Organization on a given date in the past?

6.2.2.4.3 Fields

Field Type Cardinality Description
id string (uuid) 1..1 Key.
user User 1..1
assigner User 0..1 Empty for the first member of an Organization.
A ServiceAccount user can only have a DirectMembership in its own Organization.
revoked_at datetime 0..1 When the membership ended. Rows are never deleted: who could act where, and when, stays answerable for any past write number.
revoked_by User 0..1
system_version SystemVersion 1..1
created_at datetime 1..1
updated_at datetime 1..1

6.2.2.4.4 Subtypes

Discriminator type: every OrganizationAccessControlMembership is exactly one of the subtypes below (disjoint and complete).

DirectMembership

Field Type Cardinality Description
organization Organization 1..1
role OrganizationRoleAccessControl 1..1 Owner only for the Person of Organization.owner and Sync Client only for the ServiceAccount of a sync client. A role the Organization's type offers (OrganizationRoleAccessControl.organization_types). Changing a member's role revokes this membership and creates the new one in the same transaction, under the rule of OrganizationRoleAccessControl.priority for both roles; it is not a departure, so it cascades nothing.

DelegatedMembership

Counts only when the token's active Organization (RefreshToken.organization) is the delegation's delegatee. A person acting as their own farm never uses delegated rights, and acting as the delegatee never the rights they hold in their own farm: every system checks one or the other, never both together.

Field Type Cardinality Description
delegation OrganizationDelegationMembership 1..1 Organization and role are those of the delegation (delegator, role).

6.2.2.4.5 Relationships

References

Referenced by

Uses types

SystemVersion

Subtypes

6.2.2.4.6 Rules & constraints

  • The user of a DelegatedMembership must have a DirectMembership in the delegation's delegatee.
  • A membership is active while revoked_at is empty; (user, organization, role) is unique among active DirectMemberships.
  • When a user leaves an Organization, their DirectMembership is revoked, together with the DelegatedMemberships they hold through that Organization as delegatee.
  • Leaving means losing the last active DirectMembership in the Organization: revoking one of several roles cascades nothing.
  • When a delegation is revoked, its DelegatedMemberships are revoked too.
  • A user also holds the roles of every active UserGroup they belong to (see UserGroup): their effective access is their memberships here plus the roles of their groups. access expands groups and publishes each user's effective memberships, so a product's cached copy never sees a group.