Review Organization Invite Boundaries
Map who may invite, accept, promote, and revoke members in a tenant.
An invitation is an access grant in transit. A link may be sent to the wrong address, reused after expiry, or accepted by an account that already belongs to another organization. Review the full state change rather than only the “Send invite” button. OWASP Authorization supports explicit rules for each privileged action.
Invite state machine
| State | Decision owner | Required check |
|---|---|---|
| Draft | Tenant administrator | May invite for this tenant and role |
| Sent | Server | Token bound to tenant, role, recipient, and expiry |
| Accepted | Recipient and server | Correct account, current policy, one use |
| Canceled | Tenant administrator | Old link no longer grants access |
| Expired | Server | No grant after expiry |
| Promoted | Separate role rule | Invite does not imply later admin rights |
Use synthetic accounts and two tenants. Send an A invitation, then check that its token cannot add the recipient to B. Revoke it before acceptance and verify that no membership row or notification side effect appears. Test an existing account with a different primary email, plus a role that the inviter is not allowed to grant. Do not place the full token in logs or support screenshots.
The product must decide whether an invite is bound to a specific email address or to a verified identity at acceptance. Write that rule into the artifact. If a mailbox is shared, email possession alone may not express the intended person or role. An administrator should see enough information to confirm the grant before it becomes active.
Retire invite tokens
Illustrative concurrency fixture: submit the same synthetic invitation from two controlled sessions at once. The server must consume that exact pending invite and create the membership as one guarded transition, or use an equivalent uniqueness rule. Assert one active membership, one accepted decision, and no second role grant or welcome job. A canceled invite yields zero grants even if acceptance was queued. Record whether the role is fixed at issue time or rechecked at acceptance.
OWASP multi-tenant guidance makes the organization boundary clear. This state machine gives the team tests for pending and canceled grants, not just accepted ones. Keep the test in an owned environment. If a customer asks for a review, obtain written scope for invitation testing before sending any real message.
For the role-change race, alter the proposed role before acceptance. Require the final membership and audit event to match the product's fixed-at-issue or rechecked-at-acceptance rule.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.