Invitations: Data, permissions, and operations
Stores hashed invite tokens with expiry, checks seat limits at accept time, invalidates unused invites on revoke, and binds the granted role at accept rather than encoding it in the URL.
Prevents the last owner from leaving, requires two-step ownership transfer, revokes sessions and tokens on leave, and writes an audit record for every membership change.