# Accept invitation

**Flow key:** `invitation-acceptance`

## Outcome

The intended recipient accepts one valid invitation into the correct tenant and role without token replay, address substitution, or privilege escalation.

## Actors

- Inviter/admin
- Invitee
- Identity service
- Email provider

## Preconditions and entry points

- A synthetic tenant and authorized inviter exist.
- A controllable unregistered or existing invitee address exists.
- Role and expiry policy are known.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Invitation | fresh invite to `carbon.invitee+001@example.test` | expired, revoked, accepted, resent, wrong tenant |
| Invitee | new user | existing user, signed in as different user, disabled user, multi-tenant user |
| Role | member | admin, custom role, role changed after issuance |
| Token | latest fresh invite token | old resend, malformed, replayed, link-scanner opened |
| Tenant | `CARBON Lab` | renamed, deleted, at seat limit |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Authorized inviter sends an invitation. | One invitation records tenant, recipient, role, inviter, expiry, and audit. |
| 2 | Invitee opens the latest invitation. | The page identifies tenant, inviter, role, and sign-in/signup requirements. |
| 3 | Invitee authenticates or registers as required. | Identity binding prevents another signed-in user from silently accepting. |
| 4 | Invitee confirms acceptance. | Membership is created once with no greater privilege than authorized. |
| 5 | Land in the tenant. | Navigation, permissions, seat counts, notifications, and audit agree. |
| 6 | Reuse, revoke, or resend invitation links. | Only the current valid state can create membership. |

## Alternate paths

- Existing user acceptance
- New-user registration from invite
- Domain-based auto-join
- Invite transfer/forward policy
- Bulk invitations

## Failure and recovery paths

- Seat limit reached
- Role revoked before acceptance
- Token consumed by scanner
- Timeout after membership commit
- Recipient signs in to the wrong account

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [registration and invitation](../../items/identity/registration-and-invitation.md)
- [team membership role owner assignment](../../items/identity/team-membership-role-owner-assignment.md)
- [email and outbound message](../../items/content/email-and-outbound-message.md)
- [permission](../../items/automation/permission.md)

[Back to Identity and access flows](index.md)
