Repo Groups and Guest Invites

Groups are repo-scoped, not tenant-global.

Repo group workflow

1. Select repo in Repo groups.
2. Create group name.
3. Add members from existing repo memberships.
4. Remove members when collaboration scope ends.

Membership rule:

• A user must already be a repo member before joining repo groups.

Guest invite workflow

Guest invite list is shown per selected repo.

For each invite you can:

• reissue invite token (new token)
• revoke invite

State behavior:

• accepted invites cannot be reissued/revoked
• revoked invites remain visible for auditability

Operational guardrails

• Reissue only when token delivery is compromised or expired operationally.
• Revoke immediately when guest collaboration is canceled.
• Use group-based grants for repeat guest patterns instead of ad-hoc per-user exceptions.