Settings access and lifecycle

Context boundaries

Context	Who can enter	What it owns
Personal settings	Signed-in, confirmed account	Identity, account security, preferences, invitations, and memberships
Organization group with section links	Member holding the organization’s manage_orgs capability	General, team, notifications, investor portal, and email-activity settings for that organization
Organization group with Request admin access	Organization member without administrator access	Opens a request modal; selecting Send request notifies the administrators but does not grant immediate access

Account authentication is shared across Infra One service hosts. Organization authorization is not: every organization route resolves the slug and checks the current membership and capability again.

A member who lacks manage_orgs is refused a direct organization-settings route and returned to that organization on Venture. A non-member cannot resolve the organization settings context at all and does not receive the member-only Request admin access action.

Sensitive personal changes

Change	Required proof	Lifecycle effect
Replace primary email	The intended account signed in, plus access to the proposed address and its seven-day link	Updates that signed-in account's primary address only after confirmation; the link is single-purpose
Add another email	Access to the additional address and its seven-day link	Pending confirmation becomes Confirmed; the address can then sign in to the same account
Make an email primary	Confirmed additional address	Moves notification delivery to the new primary; the old address remains a sign-in address until removed
Change password in Settings	Current password plus matching new password fields	Deletes all existing account tokens and sessions, then signs the current browser in again
Reset password by email	Valid one-day reset token	Consumes the token and deletes all account tokens and sessions
Enable 2FA	Current password, then valid six-digit authenticator code	Stores the new TOTP secret and creates ten single-use eight-character backup codes
Change the authenticator	Current password, then valid six-digit authenticator code	Replaces the TOTP secret while preserving the existing backup-code set
View backup codes or disable 2FA	Current password before the protected controls become available	Reveals the current code set or removes the sign-in challenge
Regenerate backup codes	Current password, then View backup codes	Invalidates every old backup code and creates a new set without changing the authenticator secret

Confirmed additional addresses support PIN, password, or social sign-in when the provider supplies that address. Notifications still go to the primary email.

Invitation and membership states

Membership invitations on this Settings surface cover organizations and investment accounts only.

pending → accepted → membership

pending → rejected or withdrawn → removed

Accept and reject operations are scoped to the signed-in recipient. An invitation ID alone does not authorize another account. A stale or already settled row returns That invitation is no longer available.

Membership removal has additional guards. The final organization administrator cannot leave, an investment-account owner cannot leave, and the sole remaining notification recipient cannot remove the membership or invitation that carries that topic. An investment-account member also cannot leave while they are the last active signatory in any signatory group; assign a replacement signatory first. A stale Settings row can return the generic Could not leave account, so reload and recheck the owner, notification-recipient, and signatory invariants before retrying.

Source and return behavior

When Settings receives a valid source destination, it carries that value across section links and exposes Back or Back to service. Without one, personal Settings has no synthetic return target; organization Settings falls back to the organization overview on Venture.