Settings / Team & access
The right access.
For every role.
15 named team seats included in the Core pricing thesis. Portal access is scoped separately.
Team members
3 of 15 seats · Fictional| Member | Role | Access | Authentication |
|---|---|---|---|
| Alex Kim | Admin | Company settings + operations | MFA required |
| Robin Lane | Staff | Patients, orders, equipment | Work-account sign-in |
| Sam Patel | Driver | Assigned stops only | Magic link |
Work-account sign-in
Proposed MVPGoogle Workspace
OAuth provider + explicit membership; domain alone grants no access.
Microsoft 365
Supported organizational accounts; administrator consent may be required.
Email magic links
Preview sign-inStaff and portal fallback. No patient information in authentication email.
Security policy
- Admin MFA is enforced by API and database policy
- Invitation role cannot be changed in a URL
- Removing membership revokes tenant access
- Last admin cannot remove themselves
- No shared staff logins
- Enterprise SAML / SCIM is outside MVP