**Team** in your admin sidebar lists the people who run your firm with you:
the owner, everybody who carries one of your roles, and the invitations
nobody accepted yet. Traders are under **Users**. Somebody on the team is a
trader with a role, so they can trade on your platform as well.

You need the `view_team` permission to open the screen and `manage_team` to
invite people, change a role, switch off somebody's sign-in, sign them out or
take them off the team. Without `manage_team` you see the same screen with
nothing to change.

## The list

The screen opens on the list alone, across its whole width, and shows nobody
in full until you pick them. The members come first and the invitations after
them, under their own heading.

Each member shows their email address, their role, whether they set up
two-factor, when they joined and when they were last active. A member whose
role asks for two-factor while they have none is marked, and so is somebody
who cannot sign in. Each invitation shows the address it went to, the role it
gives, who sent it and when it stops working.

Under the title the list counts the members, the open invitations and the
members without two-factor. The last two are also filters: click one to see
only those, click it again to see everybody.

The search box finds a member by name, email address, role or `usr_` id, and
an invitation by address, role or who sent it. The filter menu shows members,
invitations or both, narrows to one role or the owner, to people who can or
cannot sign in, and to people with or without two-factor. The same menu sorts
by name, role, last active or newest, and so does clicking the head of a
column. The list holds fifty to a page.

J and K move through the list and Enter opens the row they rest on. A right
click on a member offers to open them as a trader on Users, sign them out
everywhere, copy their email address, id or link, and take them off the
team. On an invitation it offers to send it again, copy the address, the id
or the link to its page in your admin panel, and revoke it. That page link is
for your team: the link the invitee joins with is only shown once, right
after sending.

## A member

Picking a member folds the list to a column on the left and slides them in
beside it. The cross or Escape folds them away again, with the list as it was.
Every member has their own address, `/admin/team/usr_...`, with the open tab
part of it.

The head says whether this is the owner or you, whether they can sign in,
whether two-factor is missing and when they were last seen. Under it: their
role, their two-factor and how they set it up, how many devices they are
signed in on, when they joined and who invited them, and how many trading
accounts they have when they trade as well.

| Tab      | What it holds | Needs |
| -------- | ------------- | ----- |
| Access   | Their role and whether they can sign in, and what that role allows, by group | |
| Sign-in  | Their authenticator app and passkeys, the devices they are signed in on now, and the ones they were signed out of | |
| Activity | What they did and what was done to their account, without page views, with a link to the full log | `view_activity_logs` |

## Changing somebody's access

The role and the sign-in switch on the Access tab are changes: pick another
role or flip the switch, and the bar at the bottom of the screen counts them
and saves them together. Below the roles the tab lists what the role you
picked allows, before you save, and how many permissions that is more or
fewer than the role they have now. When the role asks for two-factor and they
have none, the tab says so: on their next click they are sent to set it up
before they can go on.

A new role takes effect on their next click. Switching off sign-in signs them
out on their next click and keeps them out, of the admin panel and of their
trader account, and their role stays for when you switch it back on.

Three things cannot be changed here, and the server refuses them as well:

- the owner, who holds every permission without a role,
- your own role, which somebody else on the team changes,
- your own sign-in, so you cannot lock yourself out.

**Remove from the team** takes their role away after asking first. The admin
panel closes for them on their next click. Their account stays, as a trader,
with whatever they trade on, and you can add them again later.

## Signing somebody out

The Sign-in tab lists every browser and app a member is signed in on, with
its address and how they signed in. **Sign out** ends one device and **Sign
out everywhere** ends them all, both after asking first and both recorded in
the activity log. They can sign in again straight away, so to keep somebody
out, take them off the team or switch off their sign-in. Your own devices are
under your own settings, and the owner's are the owner's alone.

## Somebody new

**Invite** opens the form beside the list. There are two ways in:

- **Invite by email.** They get a mail with a link that works for 7 days,
  make their account, and arrive with the role you picked. They skip
  onboarding and identity checks. An address that already has an account at
  your firm, or an invitation that still works, cannot be invited again.
- **Somebody who trades here.** Pick a trader of your firm who can sign in
  and is not on the team yet. They keep their account and their trading
  accounts, and the admin panel opens for them with the role you picked. This
  needs `view_traders` as well, since it searches your traders.

The bar at the bottom says which of the two it does. Without any roles there
is nothing to give, and the form links to making one.

## An invitation

An invitation has its own address, `/admin/team/invites/invite_...`. It shows
the role it gives, who sent it, when and until when it works, and its history.

Right after it was sent, the invitation shows its link once, to hand over
another way than mail. Only a fingerprint of the link is kept, so it cannot be
shown later. Anybody with the link can join with that role until it expires.

- Its role is a change behind the bar at the bottom. The link stays the same,
  and the person gets the role the invitation holds when they accept.
- **Send again** mails a new link that works for 7 days and shows it once.
  The old link stops working, also where you shared it yourself.
- **Revoke invitation** stops the link at once.

An invitation that was accepted leaves the list. Its old address opens the
person who accepted it.

## In the older designs

Propper - OG and Tactical keep one screen with the invite form, the open
invitations and a table of everybody on the team. A member there opens on
Users. Changing a role, switching off sign-in, signing somebody out, adding a
trader to the team and changing the role of an invitation are only in the
standard design.