← Auth / Security

User onboarding

auth / security · features

How employees get into the system. The trust anchor — who vouches for a person — determines the path, and there are three paths:

The full frame of the model and the "floor — control, ceiling — delegation" choice are in the admission model.

Dependencies

Email is the only channel for delivering invitations, so both invite lines require SMTP to be configured — the section is in Admin Panel. Until SMTP is configured, "Invite" and "Import" are disabled. Delivery itself — including safe bulk-send pacing — is run by the Email transport.

Flow · single invite
Users shared · start · admin
"Invite" · email + role modal
Invite Accept shared · sign-up via link from email
Flow · bulk CSV
Users shared · start · admin
"Import" · upload the list
Bulk Invite · Upload step 1 · CSV file or a text list
file parsed
Bulk Invite · Preview step 2 · validation · role · send
sent · delivery via background queue
Invite Accept shared · sign-up via link from email
Flow · SSO v2

At company scale, invitations aren't needed: sign-in is delegated to the corporate IdP (Okta, Azure AD, Google Workspace), and the account is created by auto-provisioning on first sign-in. The path adds no screens of its own — it's a redirect to the IdP; the mechanics and redirect protection are in SSO / OIDC.

Login shared · "Sign in with IdP"
redirect to IdP · SAML / OIDC
Auto-provisioning account from IdP · no invitation