Organizations and roles
Owners, admins, editors, and viewers, and the rule that keeps one organization out of another.
Roles
Owners manage the organization and can change who is an owner. Admins invite, remove, and review the audit log. Editors write agents, publish versions, and create client spaces. Viewers can open rooms they were invited to and talk to the linked agents. Viewers do not see the audit log.
Tenancy
Every organization-scoped query is expected to run inside a tenant helper. The helper rejects a write aimed at a different organization and filters reads to the active one. Postgres row-level security is a later hardening step, not a control you should assume today.
Invitations
Invites last seven days, cannot grant ownership, and must be accepted by the same email address. If outbound email is not configured, the confirmation shows the link to share, and the same link stays in the list on the settings page.