Membership

Membership

A Membership links a user to an account with a specific role. Users can have memberships in multiple accounts, each with different roles.

Schema

interface Membership {
  id: string; // "mbr..." - Unique identifier
  user_id: string; // User who has membership
  account_id: string; // Account membership is in
  role: MembershipRole;
}

type MembershipRole = "owner" | "member" | "viewer";

Properties

Property	Type	Description
id	string	KSUID with mbr prefix
user_id	string	User reference
account_id	string	Account reference
role	enum	Permission level

Roles

Role	Permissions
owner	Full access, manage members, delete account
member	Read/write resources
viewer	Read-only access

Multi-Account Access

User (uid_123)
├── Membership → Account A (role: owner)
├── Membership → Account B (role: member)
└── Membership → Account C (role: viewer)

Token Claims

When accessing an account, the token includes:

{
  "uid": "uid_123",
  "acc": "acc_A",
  "role": "owner"
}

Example

{
  "id": "mbr_2kHfPZcN9xW4mE8RtY7vB",
  "user_id": "uid_1jGePYbM8wV3lD7QsX6uA",
  "account_id": "acc_3lIfQZdO0yX5nF9SuY8wC",
  "role": "member"
}

Related

• User - User resource
• Account - Account resource
• Applications - Service boundaries
• Users - User management