Messenger permissions and states

Messenger is signed-in but organization-less. An organization role shown elsewhere in Infra One does not grant blanket access to its conversations. Room access is checked when a room is loaded: membership is required for ordinary rooms, with the linked-fund policy as the documented exception. Send, reaction, edit, delete, forward, add, remove, and leave actions re-check selected-room access immediately before mutation. Archive and unarchive plus block and unblock use their own caller-specific controls. In the normal UI, Report is offered only for another participant’s nondeleted direct message; these actions are outside the selected-room recheck list.

Room access

Room type	Access rule	Membership behavior
Direct	The two participants can open the room.	A new person-to-person pair starts in a pending state when its first message is sent.
Personal Ori	The signed-in user and Ori can open the room.	Messenger creates or reuses this accepted pair on mount.
Group	Current room members can open it.	Initial members are added at creation; later additions and removals follow group rules.
Support	Current room members can open it.	The requester and Ori are initial members; Ori is protected from removal.
Fund	Room membership or the linked fund’s resource access can authorize the room.	Fund-specific access still applies.
Website chat	The visitor and seeded participants can open it.	Organization standing alone is insufficient, and the roster is read-only in Messenger.

Users who lack both the required room participation and any applicable linked-fund access are returned to the inbox. Website-chat rooms are created by the website-chat flow, which can also store an initial Ori greeting and notify configured participants; Messenger’s New chat menu does not create them.

Direct request states

State and role	Send behavior	Visible state
Pending requester	Can continue sending unless either participant blocks the other.	Your message request will be reviewed by NAME.
Pending receiver	Can read, but a send is refused and direct-room reactions are read-only even though the composer is visible.	NAME would like to message you.
Accepted	Both participants can send unless a block applies.	No pending banner.
Rejected	The pair is excluded from All, but the web client can expose a rejected banner in inconsistent deep-link/composer states.	NAME declined your message request. No supported web recovery procedure is documented.

The current web client supplies these banners without action controls. Treat them as state information rather than evidence that the visible composer can change the state.

Group and support membership

Action	Who can perform it	Constraint
Add a person	Any current group or support participant	The account must be eligible and not already present.
Add an AI agent	Any current ordinary-group participant	The agent must appear under Available AI agents or be eligible for first-mention addition. Support rooms do not expose this path.
Remove another member	The room creator	Direct rooms are immutable; Ori is protected in support rooms.
Leave	The current member of an ordinary group or support room	The final member cannot leave. Other group-shaped room types may refuse the action.

The creator can remove another ordinary member. The last member cannot leave or be removed. When the creator leaves, ownership transfers to the earliest-joined remaining member, with membership ID used to break an equal-time tie.

Archive and block states

Archive is a per-user timestamp on room membership. It does not delete the room, transcript, or membership, and it does not archive the room for anyone else. All excludes that user’s archived rooms; Archived includes them unless the current user also blocked that direct contact. A self-blocked direct appears under Blocked until it is unblocked, while its archive timestamp remains. Incoming messages do not clear the timestamp, so restoration is manual. Archived views keep reactions read-only, while archive itself is not a general send prohibition.

A block is stored from blocker to target, but direct-send prevention is symmetric: either participant’s block stops direct sends. Blocked lists only contacts the current user blocked; it does not reveal people who blocked the current user. Blocking does not remove a shared group membership or group history, and bots cannot be blocked.

Message actions

Action	Availability	Durable effect
Reply	Any persistent, nondeleted message	Prepares reply context; sending then creates a new message.
Reaction emoji	Persistent, nondeleted message while the room is writable	Adds or removes the current user’s reaction row after selected-room access is rechecked. Archived membership, either direct block, pending receiver state, or a hidden or deleted target makes the action read-only or refused.
Copy text	Nonempty, nondeleted text	Copies locally and creates no server write.
Edit	Own, nonbot, nondeleted message	Strictly less than 15 minutes after creation; atomically stores new content and edit history. The menu can remain visible after expiry.
Forward	Nondeleted source message in a group or fund room	Creates one new message per successful destination, up to 20. Partial success does not roll back.
Report	Another participant’s nondeleted direct message	Creates a pending content-report record. It does not delete or block the message.
Delete for me	Any persistent, nondeleted message	Adds the viewer to the hidden-for list; other participants continue to see it.
Delete for everyone	Own, nonbot, nondeleted message	Soft-deletes it for every participant with no undo or time limit. Replies are updated accordingly.

The report modal shows Spam, Harassment or abuse, Off-topic, and Other. At the frozen product revision, Off-topic is not accepted by the report allowlist and returns an error.

Limits

The local picker accepts five local files, each no larger than 10 MiB: .pdf, .doc, .docx, .odt, .jpg, .jpeg, .png, .webp, and .heic. These are local-picker limits, not a promise about separately enabled cloud imports.

Input	Limit
Message text	50,000 characters
Local attachments	Five local files per message, 10 MiB per file
Edit window	Strictly less than 15 minutes
New-chat and group-creation search	At most 20 active, non-suspended accounts with complete first and last names; the signed-in user is excluded, but bots are not categorically excluded
Existing-group member search	At most 20 eligible nonbot accounts; AI agents are listed separately
Forward destinations	20 distinct destination rooms offered by the picker; the source room is excluded and access is rechecked per destination
Report note	1,000 characters in the web form
Sidebar filter	The first 200 characters are retained

Attachment persistence

The Messenger web transcript does not expose the message’s internal upload status. After sending local files, wait for every intended attachment chip to appear, then reload the room and verify that all of them remain visible with the stored message. A push notification or the absence of an inline error is not proof that every selected file was stored.

Mutation and side-effect boundaries

Trigger	Stored state	Later or transient effects
First Messenger mount	Personal Ori room, accepted direct-pair record, and memberships if absent	No message or push is created.
Select a new direct account	Nothing; this is a draft	Navigation only.
Open an existing room	Current user’s stored last-message-seen timestamp; a first resource-authorized fund open can also create that user’s room-membership row	The selected transcript renders and the displayed unread count clears. This state is not another participant’s read receipt.
Receive a message while its room is open	Current user’s stored last-message-seen timestamp advances	The transcript updates in real time and the displayed unread count clears.
First direct send	Room, memberships, message, room activity, and sender read state. A person-to-person pair starts pending; a bot-backed pair starts accepted.	Participant notification can be queued.
Create group	Room, creator record, and memberships	In-app room lists update; no creation-only push.
New support request	Fresh support room, support marker, creator record, requester membership, and Ori membership	Room lists update; AI starts only after a message.
Send	Message, room activity, sender read state, and any eligible first-mentioned AI-agent membership in an ordinary group, organization chat, or fund room	Push, upload completion, and AI work can happen afterward. Support rooms do not use first-mention agent addition.
Add, remove, or leave	Membership rows; leaving creator can transfer ownership	In-app membership and room-list updates.
Archive or unarchive	Current user’s archive timestamp	Other participants are unchanged.
Block or unblock	Current user’s directional block row	Direct sends are refused while either directional block exists.
Add or remove a reaction	Current user’s reaction row on the message	Selected-room access is rechecked; read-only states refuse the write.
Edit, forward, report, or delete	Edit history, destination messages, report record, or deletion state	UI updates and notifications do not replace the durable record.

Related pages

• Messenger
• Run Messenger workflows
• Troubleshoot Messenger