Docs/Settings/Members — SanadiqCloud

Members — SanadiqCloud

Product version: 1.0.0+1 Last updated: 2026-10-07 Audience: Tenant Owners and users with tenant:user:read (owner bypasses permission checks)

A. Where Members Live

Primary navigation is the side-rail Team tab. The Settings hub also has shortcuts to Members, Invites, and Roles & policies — both entry points open the same screens.

Screen Path
Team hub /settings/team
Team roadmap /settings/team/roadmap
Members /settings/members
Member detail /settings/members/detail
Invites /settings/invites
Roles /settings/users-roles
  1. Open Team in the side rail, then Members (requires tenant:user:read or Tenant Owner).
  2. Or open Settings → hub shortcut Members.
  3. Or go directly to /settings/members.

B. Members List

The list loads organization members and supports client-side filters (search, role, status).

Columns (desktop table)

Column Description
Name Display name (owner badge when applicable)
Email Login email
Role Role label for the membership
Status Active or Inactive
Actions View, assign role, remove (when permitted)

Filters

Filter Description
Search Name, email, role, or user id
Role Narrow by role
Status All / Active / Inactive

Pending invitees are tracked on Invites, not as a member status. There is no separate “Pending member” row on this list.

Invite User

If you have tenant:user:create (or are owner), Invite User opens the Invites page. New people join only through invitations — there is no “create member” dialog on the list.

C. Member Detail

Open a row to view:

Area Contents
Hero Name, email, Owner badge (when user_id matches tenant.owner_id) or role badge, Active status
Membership Role (non-owners), Active switch when permitted (disabled for the owner row)
Dates Joined / updated timestamps
Technical details Collapsed: membership id, user id, added-by / updated-by ids
Danger zone Remove (non-owners only; owner-only action, see Permissions)

Assign role opens the full Assign roles page (/settings/users-roles/assign), not a small dialog.

Terminology

Term Meaning
User Auth identity (users)
Membership tenant_users row (user ↔ organization)
Owner Canonical ownership via tenants.owner_id (+ Owner business role)
Administrator Built-in access role — not the same as Owner

There is no separate “Tenant Entry Account” entity.

Owner protection

The organization owner row is protected: no assign/remove/deactivate actions, and the server rejects them. A message explains that ownership and this membership cannot be modified or removed here.

D. Deactivating and Removing a Member

Deactivate / reactivate

  1. Open member detail and turn the Active switch off or on.
  2. A deactivated member cannot sign in until reactivated. They cannot reactivate the account themselves.
  3. Reactivating uses a seat again. If the organization has no free seat the request is refused with HTTP 402 TENANT_SEAT_LIMIT_EXCEEDED (or TENANT_ENTITLEMENT_INACTIVE when the subscription is not active).

Remove

  1. From the list actions or member detail, choose Remove.
  2. Confirm in the dialog (Remove member? They will lose access to this organization.).
  3. The membership is ended and the person's SanadiqCloud sign-in account is deactivated, so they can no longer sign in.

Deactivating and removing are never blocked by seat limits — they free the seat.

Members who hold company stock or cash

A member who still holds company stock (stock in their custody pools, or transfers into or out of those pools that are still open) or company cash (custody cash not yet settled, or a cash settlement waiting for review) cannot be deactivated or removed. The request is refused with HTTP 409 TENANT_MEMBER_HOLDS_CUSTODY, saying whether stock, cash or both are held. Unload their stock and settle their cash first — see Custody stock and Cash settlements. If inventory or finance cannot confirm, the request is refused with HTTP 503 TENANT_CUSTODY_CHECK_UNAVAILABLE; try again shortly.

Seats

A seat is one active member; the owner counts like any other member. Pending invitations also reserve a seat. Inactive and removed members do not count. Seat limits come from your subscription in Billing.

E. Role Changes

  1. From list Assign role / detail Assign role, open Assign roles.
  2. Select roles from the catalog (owner users and owner-type roles are excluded from assignable sets as implemented).
  3. Submit — success returns to the previous screen and refreshes when the page uses pop(true).

Effective access is the union of assigned role permissions. Changes apply on subsequent authorized requests; the user does not need a special “re-login for roles” step in the UI.

F. Permissions

Action Permission
View members / detail tenant:user:read (or owner)
Invite (navigate to Invites) tenant:user:create (or owner)
Assign role tenant:user:update + role:assign as gated in UI
Toggle active (deactivate / reactivate) Organization owner only (with tenant:user:update)
Remove Organization owner only (with tenant:user:delete)

The app may show Remove or the Active switch to members whose role includes tenant:user:update / tenant:user:delete, but the server accepts these actions only from the organization owner.

Related: Invites | Settings overview | Roles overview | Assigning roles