Skip to content

6.2.2.9 UserGroupMembership

6.2.2.9.1 Purpose

Puts one user in one group for a period. The user must already be a member of the group's Organization, so a service account can join only the groups of its own Organization. Adding someone to a group never lets the person who adds them grant more than they could grant directly: they must be able to give that user every role the group holds. Rows are never deleted, so who belonged to a group at any past write stays known.

6.2.2.9.2 Questions it answers

  • Who is in this group now, and who was in it at a given time?
  • Who added or removed each member?
  • Which groups does a user belong to?

6.2.2.9.3 Fields

Field Type Cardinality Description
id string (uuid) 1..1 Key.
group UserGroup 1..1
user User 1..1 Must hold an active DirectMembership in the group's Organization (DirectMembership); a ServiceAccount can therefore join only the groups of its own Organization.
assigner User 1..1 Needs access.groups.manage, and may add a member only if they could give that member every role the group holds (OrganizationRoleAccessControl.priority): a group never lets a user grant more than they hold. Nobody adds themselves to a group.
revoked_at datetime 0..1
revoked_by User 0..1
system_version SystemVersion 1..1
created_at datetime 1..1
updated_at datetime 1..1

6.2.2.9.4 Relationships

References

Uses types

SystemVersion

6.2.2.9.5 Rules & constraints

  • (group, user) is unique among active memberships.
  • When a user leaves the Organization, their DirectMembership is revoked together with their memberships of its groups.