Organization ownership moves through verified acceptance, dual control, billing continuity checks, and a quarantine window before irreversible privilege elevation of the incoming owner.
Package status: AI-assisted reference package. Static package validation has passed; implementation scenarios remain not run and human domain review is required before stable adoption.
Decision
Initiate ownership transfer only from the current owner, require incoming member acceptance and MFA from both parties, hold a quarantine period where the successor is visible but cannot perform owner-only destructive actions, then atomically rotate owner role while preserving billing continuity checks and immutable audit history.
Scope
- Organization owner role transfer between existing members.
- Pending, quarantine, completed, cancelled, and expired transfer states.
- Billing and payment-method gates before completion.
- Notifications to admins and finance stakeholders.
Outside this block
- Merging two organizations or duplicate accounts into one.
- Inviting brand-new users who are not yet members (see invitations block).
- Domain verification or SSO tenant mapping.
Contract
- Exactly one active ownership transfer may exist per organization at a time.
- Transfer initiation requires authenticated outgoing owner session with step-up MFA per profile.
- Incoming member must accept explicitly; silent transfer without acceptance is rejected.
- During quarantine, successor appears in admin UI as pending owner but cannot delete organization, change billing account, or remove outgoing owner.
- Either party may cancel during quarantine unless profile disables outgoing cancel; cancellation restores prior roles.
- Transfer cannot complete while billing is past due or incoming owner lacks a valid payment method when required.
- Completion is atomic: owner role count remains one, outgoing owner is demoted to configured fallback role, and owner-only API tokens rotate or invalidate per product policy.
- All state transitions append audit events with actor, target member, and correlation ID retained for the profile retention period.
- Stale pending transfers expire after the profile window without changing ownership.
Implementation guidance
- Model transfer as a state machine persisted separately from membership rows until completion commits in one transaction; see
transfer-states.yamlfor allowed transitions and owner-count invariants. - Send signed email links for acceptance that expire independently of quarantine timing.
- Surface in-app banners to all admins whenever transfer is non-terminal.
- Coordinate with authorization layer so owner-only permissions check transfer state, not merely role name.
Failure handling and safeguards
- If completion transaction fails mid-commit, roll back and mark transfer as
failedwith operator alert rather than leaving zero owners. - If outgoing owner account is compromised during transfer, support break-glass freeze halts completion until identity review.
- Do not allow transfer to external email not already verified on the incoming member profile.
- Platform admin override requires ticket reference and produces high-severity audit entries.
Verification and operations
- Track initiation, acceptance, quarantine cancel, completion, and billing-block counts.
- Run quarterly drill simulating cancel during quarantine and past-due billing block.
- Verify owner-only endpoints reject successors during quarantine using automated integration tests.
Adoption assumptions
- Names and numeric values in
example.yamlare an adoption profile, not universal defaults. - Teams define fallback role for outgoing owners and whether API tokens rotate on completion.