Invite teammates with scoped roles; capability matrix gates who can read, write, and report.
One automatic gate, then a clean role-scoped handoff.
The invite button is hidden before the gate fires — only actors whose role is in inviteRoles ever see it. Once the invite is sent, a single audit row is written, and when the invitee accepts, the RLS guard enforces their scoped capability matrix from that moment onward.
Roles are enforced before the invite button appears. The canInvite gate hides or blocks the action if the actor's role is not in inviteRoles; otherwise an invite email goes out, one audit row is written, and when the invitee accepts, the capability matrix takes effect immediately via RLS.