Access Groups

Support reference for organization Access Groups, the management route at `/access-groups`, and AI teammate resource authorization.

• Access Groups connect regular organization members to regular AI teammates.
• Organization owners and admins can manage groups and can access every regular AI teammate in the organization.
• Members receive the union of AI teammates granted through all of their active Access Groups.
• Members can read and update AI teammates in that union. They cannot create or delete AI teammates and cannot manage Access Groups.
• A user's personal Ally is handled separately from Access Group grants and remains available to its owner.

• Route: `/access-groups`.
• The route is available to organization owners and admins. Other users see access denied.
• Header title: `Access Groups`.
• Description: `Manage groups and control access to organization resources`.
• Primary action: `Add`.
• Empty state: `No access groups` with `Create your first access group to manage access to organization resources.`
• Current columns: `Name`, `Added`, and `Updated`.
• Row actions: rename and delete.
• Bulk action: `Delete`.
• A completed delete offers an undo action that restores the deleted group.

• Group names are trimmed before storage.
• A name must contain 1 through 255 characters after trimming.
• Active group names are unique within an organization without regard to letter case.
• Delete is soft delete. Deleted groups can be restored through the bulk-restore API and the management-page undo action.
• Only active organization users with role `member` can be added to a group.
• Owners and admins are not group members because their AI teammate access is already organization-wide.
• The initial grantable resource type is `ai_employee`.
• Only regular AI teammates are grantable. Personal Ally and other system AI teammates are not eligible.

• Staff rows can show an `Access Groups` column for both human members and AI teammates.
• Staff filters include active Access Groups and `No Access Group`.
• Selecting several Access Group filters uses OR semantics. A row matches when it belongs to any selected group, or has no group when `No Access Group` is selected.
• Human and AI teammate profiles show an `Access Groups` field.
• Owners and admins can edit assignments directly from profile selectors. Member-facing selectors are read-only and show only groups visible to the current user.
• Adding or removing a human member changes that user's authorized AI teammate set.
• Adding or removing an AI teammate grant changes access for every active member of that group.

• The frontend listens for:
• `access_group.created`
• `access_group.renamed`
• `access_group.deleted`
• `access_group.restored`
• `access_group.member_added`
• `access_group.member_removed`
• `access_group.resource_added`
• `access_group.resource_removed`
• When the current user is removed from a group, or a group they belong to is deleted, the app shows a blocking access-revoked dialog and refreshes authorization-derived data.
• When the current user is added to a group, the app reports that new resources are available.
• When a member's group is restored, the app reports that its resources are available again.

• `GET /api/organizations/{organization_id}/access-groups`
• `POST /api/organizations/{organization_id}/access-groups`
• `GET /api/organizations/{organization_id}/access-groups/available`
• `PATCH /api/organizations/{organization_id}/access-groups/{access_group_id}`
• `DELETE /api/organizations/{organization_id}/access-groups/{access_group_id}`
• `POST /api/organizations/{organization_id}/access-groups/bulk-delete`
• `POST /api/organizations/{organization_id}/access-groups/bulk-restore`
• `PUT /api/organizations/{organization_id}/access-groups/{access_group_id}/users/{user_id}`
• `DELETE /api/organizations/{organization_id}/access-groups/{access_group_id}/users/{user_id}`
• `PUT /api/organizations/{organization_id}/access-groups/{access_group_id}/grants/{resource_type}/{resource_id}`
• `DELETE /api/organizations/{organization_id}/access-groups/{access_group_id}/grants/{resource_type}/{resource_id}`
• `GET /api/organizations/{organization_id}/audit-events`

• Organization audit events record Access Group create, rename, delete, restore, membership, and resource-grant mutations.
• Invitation create, resend, cancel, and acceptance mutations also use the organization audit-event stream.
• Owners and admins can read organization audit events across the organization.