Agent WranglersOrganisations and teams
Let organisations own the data, invite people safely, never leave a team without an owner, and cut access the moment someone leaves.
- Required 4
- Recommended 3
Required
Make invitations expire and work once
RequiredSend each invitation as a single-use link that expires within 7 days, with one role chosen at sending. Let admins see and cancel pending invitations.
Never leave an organisation without an owner
RequiredRefuse any change that leaves an organisation with no owner, such as removing, demoting or deleting its last owner.
Transfer ownership only when the new owner accepts
RequiredTransfer ownership of an organisation only after the current owner proves who they are again and the new owner accepts.
Remove access when someone leaves
RequiredWhen a member leaves or is removed, end their access to that organisation on their next request, and keep the work they made there.
Recommended
Let organisations own the shared data
RecommendedMake an organisation own the shared data, and let one person belong to several organisations. Give even a solo user an organisation of their own.
Prove a domain before trusting it
RecommendedLet an organisation claim an email domain only after it publishes a DNS TXT record you gave it. Only then may the domain route sign-in or let people join.
Keep the organisation in the address
RecommendedPut the organisation's ID or slug in every address inside it, such as
/acme/invoices/42, and take the organisation for each request from the address.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/organisations-and-teams.