Identity, User, Membership

A person who signs in is an Identity. A workspace they can enter is a Tenant (or Account). The join is Membership. Sessions hang on Identity, never on the tenant-scoped User.

This sits on top of magic-link-auth. In SQLite-per-tenant apps it also sits on activerecord-tenanted. Fizzy uses the same split in a single database.

Philosophy

1. Identity authenticates. Membership authorizes. User is the in-tenant person. Mixing these is how you leak one customer's users into another shard.
2. One email, many workspaces. Don't create a second Identity when someone joins a second tenant.
3. Create Membership globally, then the tenanted User inside with_tenant. Order matters; a User without a Membership is an orphan.
4. Join codes are shareable, not emailed magic links. Different secret, different table.

The records