1. Docs
  2. Scope Model

Identities, Memberships & Assignments

How a person exists across three scopes (Account, Application, and Environment), and what "invited", "joined", and "assigned" each mean.

Overview

A person in Canopy exists at three independent layers, and a record at one layer doesn't imply the others. Understanding the split explains why the Console's setup guide and Environment cards say what they say: why someone you invited can show as pending, or why an Environment with members can still read as Awaiting users.

The three scopes

Account → Application → Environment

Each layer answers a different question about a person:

Account: the person exists as an identity: a real human with an email and credentials. Created when an invite is accepted or by a direct admin create, not when an invite is sent.Application: the identity has joined a specific Application and can authenticate against it. An identity can exist at the Account layer with no Application membership (an invite that hasn't been accepted yet).Environment: the identity holds an active role assignment at a node in a specific Environment, so it can be authorized there. An identity can belong to an Application but have no assignments in a given Environment (an unassigned member).

Because the layers are independent, "this person exists" and "this person can do something in this Environment" are different statements. The Developer Console reflects operational reality, not just whether a row exists somewhere.

Inviting vs. accepting

Sending an invite is not the same as accepting one

This is the most common point of confusion. The two actions create different things:

Sending an invite creates an invitation and emails it. It does not create the identity, the membership, or any assignment.Accepting the invite, where the recipient clicks the link and sets a password, creates the identity, the Application membership, and (depending on the invite) an initial role assignment.Until the recipient accepts, the Invite Identities setup step shows pending ("your part is done, waiting on them"), not complete. There's no need to re-send.

What the setup states mean

The setup guide and the Environment cards read from the same data, scoped to what's operationally true for the current Application and Environment.

An Environment card shows one of three states:

Not set up: the Environment has no custom permissions, roles, or role mappings yet. The configuration layer is incomplete.Awaiting users: the configuration is done, but no identity has a role assignment in this Environment yet. Configured, but unused.Active: configured and at least one identity has a role assignment here. Operational.

The two setup steps map onto the layers above: Invite Identities is Application-scoped ("has anyone joined this App?") and Assign Role is Environment-scoped ("can anyone be authorized in this Env?"). That's why inviting someone into one Application doesn't complete the step for another, and why assigning roles in staging doesn't carry into production.

Next step

Once an identity has joined an Application, give it access by assigning a role at a hierarchy node in the target Environment.

Environment
API version
v1.0
 On this page Was this page helpful?

Tell us how we can improve this guide.

Canopy