How employees get into the system. The trust anchor — who vouches for a person — determines the path, and there are three paths:
The full frame of the model and the "floor — control, ceiling — delegation" choice are in the admission model.
Email is the only channel for delivering invitations, so both invite lines require SMTP to be configured — the section is in Admin Panel. Until SMTP is configured, "Invite" and "Import" are disabled. Delivery itself — including safe bulk-send pacing — is run by the Email transport.
At company scale, invitations aren't needed: sign-in is delegated to the corporate IdP (Okta, Azure AD, Google Workspace), and the account is created by auto-provisioning on first sign-in. The path adds no screens of its own — it's a redirect to the IdP; the mechanics and redirect protection are in SSO / OIDC.