Team access when someone leaves

Almost everywhere, work is handed over as a secret. A password, a laptop, a disk image: once it is out of your hands it is out for good.

So the honest question to ask first is the leaving one. An approach with nothing to revoke is an approach where a departure means changing every password by hand.

Read the rows as approaches rather than as product names. The last row is ours, and every cell in it came from the code.

Where an approach has no notion of a second person, the cell says so. An invented answer would be worse than a blank one.

A rank applies to the whole workspace and answers one question: how much this person may change. Ranks are ordered, so a higher one satisfies a lower requirement, and a rank the server does not recognise satisfies nothing.

• Operator

  Makes profiles in the employer's quota, shares them and deletes them. The shared creative library takes additions and deletions from any member.

• Manager

  Plus the shared working stock: folders, proxies, flows, schedules and orders in the proxy store.

• Admin

  Plus billing, the team, the log and other people's machines.

• Owner

  Everything, and the one seat nobody can take away.

Two colleagues opening one profile in the same minute produce two live sessions of one account from two places. Machines cannot see each other, so the lock is held on the server. With the app signed out, or the server out of reach, it opens the profile rather than stopping your work, and two colleagues can then land on one account.

It is held by time rather than by promise. A machine pulled from the wall stops renewing, and the profile frees itself three minutes later.

Removal and a departure by choice run one path, and everything below happens in a single transaction. Two paths to one event will eventually disagree, and one of them will forget something.

• Shares are cut

  Their access to other people's profiles goes, and access to the profiles leaving with them.

• The lock is released

  A profile they were holding opens again at once, though the list shows it busy until the old lock lapses.

• A date splits the profiles

  What was made inside the workspace passes to the owner, and what they brought goes with them.

• Working proxies stay behind

  A pool proxy of the employer is stripped from a leaving profile, stored copy and all.

• Unused invites die

  A second code on the same address stops being a way back in.

• Machines and folder access go

  Devices are unlinked, and the folder restriction does not travel to the next employer.

Every action worth arguing about writes one row: who, what, when and which workspace it belonged to. The workspace is stamped as it is written, so a colleague leaving does not empty the history.

Names are frozen as they were that day. Renaming a profile today does not rewrite last week.