Account membership and site association

Stable

Applies to: Vexal Hub 0.3.006+

Hub tenancy is account-centric. There is no separate site-membership table.

Authorization chain

User
  ↓
Tenant / Account (active membership)
  ↓
Site (site.account_id = that account)
  ↓
Permission (vexal_hub_access + membership role)
  ↓
Workspace

Membership roles

owner, manager, viewer on active accounts. Last-owner protection applies on active accounts.

vexal_hub_access

Not authentication — WordPress cookies prove identity.
Coarse authorization — may use Workspace routes.
Insufficient alone — membership and site association still required.

Site association

Operators assign sites to accounts via Operator Console. Moving a site does not rotate machine credentials.

Customer provisioning

Operators create customers as WordPress subscriber users, attach membership, optionally grant Workspace access. Password setup uses WordPress notification / reset—no plaintext passwords in Hub UI.