Team UI

scripts/verify-personal-org.mjs

@@ -0,0 +1,32 @@
+// Standalone JS port of `lib/personal-org.ts::isPersonalOrgName`
+// for offline verification.
+
+const PERSONAL_ORG_SUFFIX = " (Personal)";
+
+function isPersonalOrgName(orgName) {
+  if (!orgName) return false;
+  return orgName.trimEnd().endsWith(PERSONAL_ORG_SUFFIX);
+}
+
+const cases = [
+  ["Bob Müller (Personal)", true,  "personal account"],
+  ["Acme GmbH",             false, "company"],
+  ["Acme (Personal) Ltd",   false, "suffix in middle does not count"],
+  ["Bob (Personal)  ",      true,  "trailing whitespace tolerated"],
+  ["Bob (personal)",        false, "case-sensitive — lowercase doesn't match"],
+  ["",                      false, "empty"],
+  [null,                    false, "null"],
+  [undefined,               false, "undefined"],
+  ["Bob (Personal)x",       false, "non-trailing suffix"],
+  [" (Personal)",           true,  "minimal — empty user name (degenerate but matches)"],
+];
+
+let pass = 0, fail = 0;
+for (const [name, expected, note] of cases) {
+  const got = isPersonalOrgName(name);
+  const ok = got === expected;
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${got}  want=${expected}  [${note}]  input=${JSON.stringify(name)}`);
+  if (ok) pass++; else fail++;
+}
+console.log(`\n${pass} pass, ${fail} fail`);
+process.exit(fail === 0 ? 0 : 1);

scripts/verify-role-gates.mjs

@@ -0,0 +1,38 @@
+// Standalone JS port of `lib/session.ts::canMutate` and `isCustomerOwner`
+// for offline verification.
+//
+// SessionUser shape mirrors the TypeScript interface:
+//   { roles: Role[], isPlatform: boolean, ... }
+
+function canMutate(user) {
+  return user.isPlatform || user.roles.includes("owner");
+}
+
+function isCustomerOwner(user) {
+  return !user.isPlatform && user.roles.includes("owner");
+}
+
+const cases = [
+  // [user, fn, expected, note]
+  [{ isPlatform: true,  roles: ["platform_admin"] },          canMutate, true,  "platform admin can mutate"],
+  [{ isPlatform: true,  roles: ["platform_operator"] },       canMutate, true,  "platform operator can mutate"],
+  [{ isPlatform: false, roles: ["owner"] },                   canMutate, true,  "customer owner can mutate"],
+  [{ isPlatform: false, roles: ["user"] },                    canMutate, false, "customer user cannot mutate"],
+  [{ isPlatform: false, roles: [] },                          canMutate, false, "no roles cannot mutate"],
+  [{ isPlatform: false, roles: ["owner", "user"] },           canMutate, true,  "owner+user (owner wins)"],
+
+  [{ isPlatform: true,  roles: ["platform_admin", "owner"] }, isCustomerOwner, false, "platform user with owner role is NOT customerOwner"],
+  [{ isPlatform: false, roles: ["owner"] },                   isCustomerOwner, true,  "pure customer owner"],
+  [{ isPlatform: false, roles: ["user"] },                    isCustomerOwner, false, "customer user is not customerOwner"],
+  [{ isPlatform: false, roles: [] },                          isCustomerOwner, false, "empty roles is not customerOwner"],
+];
+
+let pass = 0, fail = 0;
+for (const [user, fn, expected, note] of cases) {
+  const got = fn(user);
+  const ok = got === expected;
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${got}  want=${expected}  [${note}]`);
+  if (ok) pass++; else fail++;
+}
+console.log(`\n${pass} pass, ${fail} fail`);
+process.exit(fail === 0 ? 0 : 1);

scripts/verify-team.mjs

@@ -0,0 +1,98 @@
+// Standalone JS port of `lib/team.ts::isValidInviteRole` and the
+// org-membership decision used by POST /api/tenants/[name]/assignments.
+
+function isValidInviteRole(role) {
+  return role === "owner" || role === "user";
+}
+
+// Mirrors the assignment-time check: target user must exist in the
+// org's member list. Returns true if assign should proceed.
+function canAssign(targetUserId, orgMembers) {
+  return orgMembers.some((m) => m.userId === targetUserId);
+}
+
+// Mirrors the dropdown candidate-filter on the AssignedUsersPanel:
+// only `user`-role members who aren't already assigned, excluding
+// owners (who have implicit access).
+function pickCandidates(orgMembers, alreadyAssigned) {
+  const assigned = new Set(alreadyAssigned);
+  return orgMembers.filter(
+    (m) =>
+      !assigned.has(m.userId) &&
+      m.roles.includes("user") &&
+      !m.roles.includes("owner")
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Test fixtures
+// ---------------------------------------------------------------------------
+
+const orgMembers = [
+  { userId: "u-1", roles: ["owner"] },
+  { userId: "u-2", roles: ["user"] },
+  { userId: "u-3", roles: ["user"] },
+  { userId: "u-4", roles: [] },           // member with no role yet
+  { userId: "u-5", roles: ["owner", "user"] }, // dual-role
+];
+
+let pass = 0, fail = 0;
+
+console.log("--- isValidInviteRole ---");
+const inviteCases = [
+  ["owner", true,  "owner is valid"],
+  ["user",  true,  "user is valid"],
+  ["viewer", false, "viewer rejected (dropped in Slice 5)"],
+  ["platform_admin", false, "platform_admin not invitable"],
+  ["platform_operator", false, "platform_operator not invitable"],
+  ["", false, "empty rejected"],
+  ["OWNER", false, "case-sensitive"],
+];
+for (const [role, expected, note] of inviteCases) {
+  const got = isValidInviteRole(role);
+  const ok = got === expected;
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${got}  want=${expected}  [${note}]`);
+  if (ok) pass++; else fail++;
+}
+
+console.log("\n--- canAssign (membership check) ---");
+const assignCases = [
+  ["u-1", true,  "owner can be assigned (idempotent for owners)"],
+  ["u-2", true,  "user-role member can be assigned"],
+  ["u-99", false, "non-member rejected"],
+  ["", false, "empty userId rejected"],
+];
+for (const [targetId, expected, note] of assignCases) {
+  const got = canAssign(targetId, orgMembers);
+  const ok = got === expected;
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${got}  want=${expected}  [${note}]`);
+  if (ok) pass++; else fail++;
+}
+
+console.log("\n--- pickCandidates (assign dropdown) ---");
+const candidateCases = [
+  {
+    assigned: [],
+    expected: ["u-2", "u-3"],
+    note: "user-role members minus owners (u-5 is owner+user, excluded)",
+  },
+  {
+    assigned: ["u-2"],
+    expected: ["u-3"],
+    note: "u-2 already assigned, only u-3 remains",
+  },
+  {
+    assigned: ["u-2", "u-3"],
+    expected: [],
+    note: "everyone assigned",
+  },
+];
+for (const c of candidateCases) {
+  const got = pickCandidates(orgMembers, c.assigned).map((m) => m.userId);
+  const ok = JSON.stringify(got) === JSON.stringify(c.expected);
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${JSON.stringify(got)}  want=${JSON.stringify(c.expected)}  [${c.note}]`);
+  if (ok) pass++; else fail++;
+}
+
+console.log(`\n${pass} pass, ${fail} fail`);
+process.exit(fail === 0 ? 0 : 1);

scripts/verify-visibility.mjs

@@ -0,0 +1,120 @@
+// Standalone JS port of `lib/visibility.ts` for offline verification.
+// Mirrors the synchronous decision logic — DB call (assignments) is
+// faked as an array param.
+
+function scopeFor(user) {
+  if (user.isPlatform) return "all";
+  if (user.roles.includes("owner")) return "org";
+  return "assigned";
+}
+
+function listVisibleTenants(user, all, assignments = []) {
+  const scope = scopeFor(user);
+  if (scope === "all") return all;
+
+  const orgScoped = all.filter(
+    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
+  );
+  if (scope === "org") return orgScoped;
+
+  const allowed = new Set(assignments);
+  return orgScoped.filter((t) => allowed.has(t.metadata.name));
+}
+
+function canUserSeeTenant(user, tenant, assignments = []) {
+  const scope = scopeFor(user);
+  if (scope === "all") return true;
+  if (tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] !== user.orgId) {
+    return false;
+  }
+  if (scope === "org") return true;
+  return assignments.includes(tenant.metadata.name);
+}
+
+function canSeeInflightRequests(user) {
+  return scopeFor(user) !== "assigned";
+}
+
+// ---------------------------------------------------------------------------
+// Test fixtures
+// ---------------------------------------------------------------------------
+
+const platformAdmin = { isPlatform: true,  roles: ["platform_admin"], orgId: "platform-org", id: "u-admin" };
+const owner         = { isPlatform: false, roles: ["owner"],          orgId: "org-acme",     id: "u-owner" };
+const userOnly      = { isPlatform: false, roles: ["user"],           orgId: "org-acme",     id: "u-alice" };
+const noRoles       = { isPlatform: false, roles: [],                 orgId: "org-acme",     id: "u-bob" };
+
+const tenantA = { metadata: { name: "acme-prod-12345678", labels: { "pieced.ch/zitadel-org-id": "org-acme" } } };
+const tenantB = { metadata: { name: "acme-dev-87654321",  labels: { "pieced.ch/zitadel-org-id": "org-acme" } } };
+const tenantC = { metadata: { name: "other-corp-aaaa",    labels: { "pieced.ch/zitadel-org-id": "org-other" } } };
+
+const allTenants = [tenantA, tenantB, tenantC];
+
+// ---------------------------------------------------------------------------
+// listVisibleTenants
+// ---------------------------------------------------------------------------
+
+const listCases = [
+  { user: platformAdmin, assignments: [],                    expected: ["acme-prod-12345678", "acme-dev-87654321", "other-corp-aaaa"], note: "platform sees all" },
+  { user: owner,         assignments: [],                    expected: ["acme-prod-12345678", "acme-dev-87654321"],                    note: "owner sees all org tenants" },
+  { user: owner,         assignments: ["acme-prod-12345678"], expected: ["acme-prod-12345678", "acme-dev-87654321"],                   note: "owner ignores assignment table even if rows exist" },
+  { user: userOnly,      assignments: [],                    expected: [],                                                            note: "user with no assignments sees nothing" },
+  { user: userOnly,      assignments: ["acme-prod-12345678"], expected: ["acme-prod-12345678"],                                       note: "user sees only assigned tenants" },
+  { user: userOnly,      assignments: ["acme-prod-12345678", "acme-dev-87654321"], expected: ["acme-prod-12345678", "acme-dev-87654321"], note: "user sees multiple assigned tenants" },
+  { user: userOnly,      assignments: ["other-corp-aaaa"],   expected: [],                                                            note: "stale assignment to other-org tenant doesn't leak" },
+  { user: noRoles,       assignments: [],                    expected: [],                                                            note: "no roles is treated as user-scope (empty)" },
+];
+
+let pass = 0, fail = 0;
+
+console.log("--- listVisibleTenants ---");
+for (const c of listCases) {
+  const got = listVisibleTenants(c.user, allTenants, c.assignments).map((t) => t.metadata.name);
+  const ok = JSON.stringify(got) === JSON.stringify(c.expected);
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${JSON.stringify(got)}  want=${JSON.stringify(c.expected)}  [${c.note}]`);
+  if (ok) pass++; else fail++;
+}
+
+// ---------------------------------------------------------------------------
+// canUserSeeTenant
+// ---------------------------------------------------------------------------
+
+console.log("\n--- canUserSeeTenant ---");
+const seeCases = [
+  { user: platformAdmin, tenant: tenantA, assignments: [],                    expected: true,  note: "platform sees same-cluster tenant" },
+  { user: platformAdmin, tenant: tenantC, assignments: [],                    expected: true,  note: "platform sees other-org tenant" },
+  { user: owner,         tenant: tenantA, assignments: [],                    expected: true,  note: "owner sees own-org tenant" },
+  { user: owner,         tenant: tenantC, assignments: [],                    expected: false, note: "owner does NOT see other-org tenant" },
+  { user: userOnly,      tenant: tenantA, assignments: ["acme-prod-12345678"], expected: true,  note: "user sees assigned tenant" },
+  { user: userOnly,      tenant: tenantA, assignments: [],                    expected: false, note: "user does NOT see un-assigned own-org tenant" },
+  { user: userOnly,      tenant: tenantC, assignments: ["other-corp-aaaa"],   expected: false, note: "user does NOT see other-org tenant even with stale assignment" },
+];
+
+for (const c of seeCases) {
+  const got = canUserSeeTenant(c.user, c.tenant, c.assignments);
+  const ok = got === c.expected;
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${got}  want=${c.expected}  [${c.note}]`);
+  if (ok) pass++; else fail++;
+}
+
+// ---------------------------------------------------------------------------
+// canSeeInflightRequests
+// ---------------------------------------------------------------------------
+
+console.log("\n--- canSeeInflightRequests ---");
+const requestCases = [
+  { user: platformAdmin, expected: true,  note: "platform sees in-flight" },
+  { user: owner,         expected: true,  note: "owner sees in-flight" },
+  { user: userOnly,      expected: false, note: "user-role does NOT see in-flight" },
+  { user: noRoles,       expected: false, note: "no-roles does NOT see in-flight" },
+];
+
+for (const c of requestCases) {
+  const got = canSeeInflightRequests(c.user);
+  const ok = got === c.expected;
+  console.log(`${ok ? "PASS" : "FAIL"}  got=${got}  want=${c.expected}  [${c.note}]`);
+  if (ok) pass++; else fail++;
+}
+
+console.log(`\n${pass} pass, ${fail} fail`);
+process.exit(fail === 0 ? 0 : 1);

src/app/[locale]/dashboard/new/page.tsx

@@ -1,4 +1,4 @@
-import { getSessionUser } from "@/lib/session";
+import { getSessionUser, canMutate } from "@/lib/session";
 import { getTranslations } from "next-intl/server";
 import { redirect } from "next/navigation";
 import { OnboardingFlow } from "@/components/onboarding/onboarding-flow";
@@ -16,11 +16,17 @@ import Link from "next/link";
  *
  * Platform admins are redirected to /dashboard — they shouldn't be
  * creating tenant instances under their own org.
+ *
+ * Slice 5: customer-side `user` role is also redirected — only owners
+ * may create new instances. The server-side POST handler enforces the
+ * same; this redirect is purely UX so /user-role members don't land on
+ * a wizard that will 403 on submit.
  */
 export default async function NewInstancePage() {
   const user = await getSessionUser();
   if (!user) redirect("/login");
   if (user.isPlatform) redirect("/dashboard");
+  if (!canMutate(user)) redirect("/dashboard");
 
   const t = await getTranslations("dashboard");
 

src/app/[locale]/dashboard/page.tsx

@@ -1,8 +1,13 @@
-import { getSessionUser } from "@/lib/session";
+import { getSessionUser, canMutate } from "@/lib/session";
 import { getTranslations, getFormatter } from "next-intl/server";
 import { redirect } from "next/navigation";
 import { listTenants } from "@/lib/k8s";
 import { listActiveTenantRequestsByOrgId } from "@/lib/db";
+import {
+  listVisibleTenants,
+  canSeeInflightRequests,
+  isUserScoped,
+} from "@/lib/visibility";
 import { Card, CardHeader } from "@/components/ui/card";
 import { StatusBadge } from "@/components/ui/status-badge";
 import { OnboardingFlow } from "@/components/onboarding/onboarding-flow";
@@ -134,23 +139,117 @@ export default async function DashboardPage() {
   }
 
   // ---------------------------------------------------------------------
-  // Customer view (Slice 3 multi-tenant)
+  // Customer view (Slice 3 multi-tenant + Slice 6 visibility scoping)
   // ---------------------------------------------------------------------
 
-  const orgTenants = allTenants.filter(
+  // Slice 6: orgTenants becomes "visible tenants for this user". For an
+  // owner that's all of the org's tenants; for a `user`-role member
+  // it's only the tenants they've been assigned to via
+  // tenant_user_assignments. The dashboard renders fewer cards in the
+  // user-role case but otherwise uses the same template.
+  const orgTenants = await listVisibleTenants(user, allTenants);
+
+  // For the "no instances yet" empty state, we want to know whether
+  // this user is being scoped down. A `user`-role with 0 visible
+  // tenants gets a different message than an owner with 0 tenants
+  // (the user might just need an assignment; the owner needs to
+  // create one).
+  const userScoped = isUserScoped(user);
+
+  // Pending/in-flight requests are only shown to roles that can act on
+  // them. `user`-role customers see no request cards.
+  const orgRequests = canSeeInflightRequests(user)
+    ? await listActiveTenantRequestsByOrgId(user.orgId)
+    : [];
+
+  // Pending requests that don't yet have a tenant CR. Once the CR
+  // exists, the tenant card carries the live phase, so a separate
+  // "request" card would just duplicate it. We compare against
+  // *all* org tenants here (not just visible ones) — otherwise a
+  // request whose tenant is invisible to the caller would erroneously
+  // show as in-flight.
+  const orgScopedTenants = allTenants.filter(
     (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
   );
-  const orgRequests = await listActiveTenantRequestsByOrgId(user.orgId);
-
-  // Pending/in-flight requests that don't yet have a tenant CR. Once the
-  // CR exists, the tenant card carries the live phase, so a separate
-  // "request" card would just duplicate it.
   const inflightRequests = orgRequests.filter(
-    (r) => !r.tenantName || !orgTenants.some((t) => t.metadata.name === r.tenantName)
+    (r) => !r.tenantName || !orgScopedTenants.some((t) => t.metadata.name === r.tenantName)
   );
 
-  // First-time user: empty company. Show the onboarding wizard inline.
+  // Slice 5: only owners (and platform users, who'd typically be using
+  // the admin panel anyway) see the "Create new instance" link. A
+  // `user`-role member sees the dashboard but not the create flow —
+  // they need to ask an owner.
+  const canCreate = canMutate(user);
+
+  // First-time / no-visibility branch.
+  //
+  // Three sub-cases:
+  //   1. owner / platform with 0 tenants and 0 requests → show wizard.
+  //   2. owner / platform with 0 visibility but the org HAS tenants →
+  //      shouldn't happen (owners see all org tenants). Defensive
+  //      fall-through to the wizard.
+  //   3. user-role with 0 visible tenants → show "ask your owner"
+  //      message, with copy distinguishing whether the org has any
+  //      tenants at all.
   if (orgTenants.length === 0 && inflightRequests.length === 0) {
+    if (userScoped) {
+      // Slice 6 empty state for `user` role. The org might or might
+      // not have tenants — either way this user has none assigned.
+      // The two messages are subtly different: "no instances exist"
+      // means owner needs to create one; "you're not assigned" means
+      // owner needs to grant access.
+      const orgHasTenants = orgScopedTenants.length > 0;
+      return (
+        <div>
+          <div className="mb-8 animate-in">
+            <h1 className="font-display text-2xl font-semibold accent-rule mb-2">
+              {t("title")}
+            </h1>
+            <p className="text-text-secondary text-sm mt-4">
+              {t("welcome", { name: user.name || user.email })}
+            </p>
+          </div>
+          <Card className="animate-in animate-in-delay-1">
+            <div className="text-center py-6">
+              <h2 className="font-display text-base font-semibold text-text-primary mb-2">
+                {orgHasTenants
+                  ? t("noAssignmentsTitle")
+                  : t("noInstancesYetTitle")}
+              </h2>
+              <p className="text-sm text-text-secondary max-w-sm mx-auto">
+                {orgHasTenants
+                  ? t("noAssignmentsDescription")
+                  : t("noInstancesYetDescription")}
+              </p>
+            </div>
+          </Card>
+        </div>
+      );
+    }
+
+    if (!canCreate) {
+      // Belt-and-braces: any role that's neither owner-with-create nor
+      // user-scope ends up here (e.g. weird cases like a session with
+      // no roles at all). Same generic message as before.
+      return (
+        <div>
+          <div className="mb-8 animate-in">
+            <h1 className="font-display text-2xl font-semibold accent-rule mb-2">
+              {t("title")}
+            </h1>
+            <p className="text-text-secondary text-sm mt-4">
+              {t("welcome", { name: user.name || user.email })}
+            </p>
+          </div>
+          <Card className="animate-in animate-in-delay-1">
+            <p className="text-sm text-text-secondary text-center py-6">
+              {t("noAccessNoInstances")}
+            </p>
+          </Card>
+        </div>
+      );
+    }
+
     return (
       <div>
         <div className="mb-8 animate-in">
@@ -170,7 +269,7 @@ export default async function DashboardPage() {
   }
 
   // Returning customer: list of tenants + in-flight requests, plus
-  // a button to add another instance.
+  // a button to add another instance (owners only).
   return (
     <div>
       <div className="mb-8 animate-in flex items-start justify-between gap-4">
@@ -183,12 +282,14 @@ export default async function DashboardPage() {
           </p>
         </div>
 
-        <Link
-          href="/dashboard/new"
-          className="shrink-0 inline-flex items-center gap-1.5 py-2 px-4 bg-accent text-white text-xs font-medium rounded-lg hover:bg-accent-dim transition-colors"
-        >
-          <span>+</span> {t("createInstance")}
-        </Link>
+        {canCreate && (
+          <Link
+            href="/dashboard/new"
+            className="shrink-0 inline-flex items-center gap-1.5 py-2 px-4 bg-accent text-white text-xs font-medium rounded-lg hover:bg-accent-dim transition-colors"
+          >
+            <span>+</span> {t("createInstance")}
+          </Link>
+        )}
       </div>
 
       {/* In-flight (pending/approved/provisioning/rejected) requests */}

src/app/[locale]/register/page.tsx

@@ -7,6 +7,13 @@ import { Card } from "@/components/ui/card";
 
 type FormState = "idle" | "submitting" | "success" | "error";
 
+/**
+ * Slice 4: a "Register as individual" toggle distinguishes personal
+ * accounts from company registrations. When the toggle is on:
+ *   - the company name field is hidden (and not sent)
+ *   - the server skips the duplicate-domain check
+ *   - the ZITADEL org is named "{givenName} {familyName} (Personal)"
+ */
 export default function RegisterPage() {
   const t = useTranslations("register");
   const tCommon = useTranslations("common");
@@ -18,6 +25,7 @@ export default function RegisterPage() {
     familyName: "",
     email: "",
   });
+  const [isPersonal, setIsPersonal] = useState(false);
   const [state, setState] = useState<FormState>("idle");
   const [error, setError] = useState("");
 
@@ -31,15 +39,23 @@ export default function RegisterPage() {
     setState("submitting");
 
     try {
+      // Build the request body explicitly. For personals we omit
+      // companyName so the server knows to derive the org name from
+      // the user's full name. The Zod schema accepts the omission.
+      const body: Record<string, unknown> = {
+        givenName: form.givenName,
+        familyName: form.familyName,
+        email: form.email,
+        isPersonal,
+      };
+      if (!isPersonal) {
+        body.companyName = form.companyName;
+      }
+
       const res = await fetch("/api/register", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          companyName: form.companyName,
-          givenName: form.givenName,
-          familyName: form.familyName,
-          email: form.email,
-        }),
+        body: JSON.stringify(body),
       });
 
       if (!res.ok) {
@@ -104,21 +120,41 @@ export default function RegisterPage() {
 
         <Card className="animate-in animate-in-delay-1">
           <form onSubmit={handleSubmit} className="space-y-4">
-            {/* Company name */}
-            <div>
-              <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
-                {t("companyName")}
-              </label>
+            {/* Personal-account toggle */}
+            <label className="flex items-start gap-3 cursor-pointer select-none p-3 rounded-lg border border-border bg-surface-2 hover:border-accent/40 transition-colors">
               <input
-                name="companyName"
-                type="text"
-                required
-                value={form.companyName}
-                onChange={handleChange}
-                placeholder={t("companyNamePlaceholder")}
-                className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+                type="checkbox"
+                checked={isPersonal}
+                onChange={(e) => setIsPersonal(e.target.checked)}
+                className="mt-0.5 h-4 w-4 rounded border-border bg-surface-1 text-accent focus:ring-1 focus:ring-accent focus:ring-offset-0"
               />
-            </div>
+              <div className="flex-1 min-w-0">
+                <div className="text-sm font-medium text-text-primary">
+                  {t("individualToggle")}
+                </div>
+                <div className="text-xs text-text-muted mt-0.5">
+                  {t("individualHint")}
+                </div>
+              </div>
+            </label>
+
+            {/* Company name — hidden for personal */}
+            {!isPersonal && (
+              <div>
+                <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+                  {t("companyName")}
+                </label>
+                <input
+                  name="companyName"
+                  type="text"
+                  required
+                  value={form.companyName}
+                  onChange={handleChange}
+                  placeholder={t("companyNamePlaceholder")}
+                  className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+                />
+              </div>
+            )}
 
             {/* Name row */}
             <div className="grid grid-cols-2 gap-3">
@@ -161,7 +197,7 @@ export default function RegisterPage() {
                 required
                 value={form.email}
                 onChange={handleChange}
-                placeholder="you@company.ch"
+                placeholder={isPersonal ? "you@example.ch" : "you@company.ch"}
                 className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
               />
             </div>

src/app/[locale]/team/page.tsx

@@ -0,0 +1,65 @@
+import { getSessionUser, canMutate } from "@/lib/session";
+import { getTranslations } from "next-intl/server";
+import { redirect } from "next/navigation";
+import { getOrgMembers } from "@/lib/team";
+import { Card } from "@/components/ui/card";
+import { TeamList } from "@/components/team/team-list";
+import { InviteForm } from "@/components/team/invite-form";
+import Link from "next/link";
+
+/**
+ * /team — manage org members.
+ *
+ * Visible to owners and platform users only (`canMutate`). User-role
+ * members are redirected away — they shouldn't browse the roster.
+ *
+ * The page loads members server-side for the initial render. The
+ * `<TeamList>` and `<InviteForm>` client components handle live
+ * updates after invites and refreshes.
+ */
+export default async function TeamPage() {
+  const user = await getSessionUser();
+  if (!user) redirect("/login");
+  if (!canMutate(user)) redirect("/dashboard");
+
+  const t = await getTranslations("team");
+  const tDashboard = await getTranslations("dashboard");
+
+  const members = await getOrgMembers(user.orgId);
+
+  return (
+    <div>
+      <div className="mb-8 animate-in">
+        <Link
+          href="/dashboard"
+          className="inline-flex items-center gap-1.5 mb-4 text-xs font-medium text-text-muted hover:text-text-primary transition-colors"
+        >
+          <span>←</span> {tDashboard("title")}
+        </Link>
+        <h1 className="font-display text-2xl font-semibold accent-rule mb-2">
+          {t("title")}
+        </h1>
+        <p className="text-text-secondary text-sm mt-4">{t("description")}</p>
+      </div>
+
+      <section className="mb-8 animate-in animate-in-delay-1">
+        <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
+          {t("inviteSectionTitle")}
+        </h2>
+        <Card>
+          <InviteForm />
+        </Card>
+      </section>
+
+      <section className="animate-in animate-in-delay-2">
+        <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
+          {t("membersSectionTitle")}{" "}
+          <span className="text-text-muted/60 tabular-nums">
+            ({members.length})
+          </span>
+        </h2>
+        <TeamList initialMembers={members} currentUserId={user.id} />
+      </section>
+    </div>
+  );
+}

src/app/[locale]/tenants/[name]/page.tsx

@@ -1,12 +1,14 @@
-import { getSessionUser } from "@/lib/session";
+import { getSessionUser, canMutate } from "@/lib/session";
 import { getTranslations, getFormatter } from "next-intl/server";
 import { redirect, notFound } from "next/navigation";
 import { getTenant } from "@/lib/k8s";
+import { canUserSeeTenant } from "@/lib/visibility";
 import { StatusBadge } from "@/components/ui/status-badge";
 import { UsageDisplay } from "@/components/dashboard/usage-display";
 import { PackageList } from "@/components/packages/package-list";
 import { WorkspaceEditor } from "@/components/packages/workspace-editor";
 import { ChannelUsers } from "@/components/channel-users/channel-users";
+import { AssignedUsersPanel } from "@/components/tenants/assigned-users-panel";
 import { formatDateTime, formatRelative } from "@/lib/format";
 
 const CHANNEL_PACKAGES = ["telegram", "discord", "email"];
@@ -26,14 +28,18 @@ export default async function TenantDetailPage({
   const tenant = await getTenant(name);
   if (!tenant) notFound();
 
-  // Scope check
-  if (
-    !user.isPlatform &&
-    tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] !== user.orgId
-  ) {
+  // Slice 6: visibility check encompasses org membership AND, for
+  // user-role members, the tenant_user_assignments check. notFound()
+  // (404) rather than redirect/403 to avoid leaking tenant existence.
+  if (!(await canUserSeeTenant(user, tenant))) {
     notFound();
   }
 
+  // Slice 5: editable surface gated on owner role. Platform users always
+  // can edit; customer-side, only `owner` may. `user`-role members see
+  // the same page but with edit controls hidden / fields read-only.
+  const canEdit = canMutate(user);
+
   const enabledPackages = tenant.spec.packages || [];
   const workspaceFiles = tenant.spec.workspaceFiles || {};
   const enabledChannels = enabledPackages.filter((pkg) =>
@@ -100,6 +106,7 @@ export default async function TenantDetailPage({
           tenantName={name}
           enabledPackages={enabledPackages}
           conditions={tenant.status?.conditions}
+          canEdit={canEdit}
         />
       </section>
 
@@ -110,6 +117,7 @@ export default async function TenantDetailPage({
             tenantName={name}
             enabledChannels={enabledChannels}
             initialChannelUsers={channelUsers}
+            canEdit={canEdit}
           />
         </section>
       )}
@@ -119,7 +127,17 @@ export default async function TenantDetailPage({
         <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
           {t("workspaceFiles")}
         </h2>
-        <WorkspaceEditor tenantName={name} files={workspaceFiles} />
+        <WorkspaceEditor tenantName={name} files={workspaceFiles} canEdit={canEdit} />
+      </section>
+
+      {/* Slice 7: Assigned users — visible to anyone who can see the
+          tenant, editable only by owners/platform users. The component
+          fetches its own data so the page doesn't need to await. */}
+      <section className="mt-8 animate-in animate-in-delay-4">
+        <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
+          {t("assignedUsers")}
+        </h2>
+        <AssignedUsersPanel tenantName={name} canEdit={canEdit} />
       </section>
     </div>
   );

src/app/api/admin/requests/[id]/approve/route.ts

@@ -63,10 +63,10 @@ export async function POST(
   const isReApproval = tenantRequest.status === "rejected";
 
   // Build the CR name: see `lib/tenant-naming.ts` for the format spec.
-  // For now all approvals are kind="company" — the personal branch is
-  // wired but unused until Slice 4 introduces the `is_personal` column.
+  // Slice 4: for personal accounts the slug is replaced by the literal
+  // "p-" prefix so no PII is embedded in the K8s namespace name.
   const tenantName = deriveTenantName(
-    "company",
+    tenantRequest.isPersonal ? "personal" : "company",
     tenantRequest.companyName,
     tenantRequest.id
   );
@@ -101,13 +101,17 @@ export async function POST(
     };
 
     // Step 4: Create the PiecedTenant CR.
-    // displayName: prefer the customer-chosen instance name; fall back to
-    // the company name. With multi-tenant per org, instanceName is what
-    // distinguishes "Acme Production" from "Acme Dev" on the dashboard.
+    // displayName precedence:
+    //   1. customer-chosen instance name (Slice 3 multi-tenant)
+    //   2. for personal accounts, the contact name (avoids exposing the
+    //      synthetic "{name} (Personal)" company name in the OpenClaw UI)
+    //   3. company name otherwise
     const displayName =
       tenantRequest.instanceName && tenantRequest.instanceName.trim().length > 0
         ? tenantRequest.instanceName.trim()
-        : tenantRequest.companyName;
+        : tenantRequest.isPersonal
+          ? tenantRequest.contactName || "Assistant"
+          : tenantRequest.companyName;
 
     await createTenant(
       tenantName,

src/app/api/admin/tenants/[name]/delete/route.ts

@@ -1,13 +1,21 @@
 import { NextResponse } from "next/server";
 import { requirePlatformRole } from "@/lib/session";
 import { getTenant, deleteTenant } from "@/lib/k8s";
-import { markTenantRequestDeletedByTenantName } from "@/lib/db";
+import {
+  markTenantRequestDeletedByTenantName,
+  removeAllAssignmentsForTenant,
+} from "@/lib/db";
 import { safeError } from "@/lib/errors";
 
 /**
  * POST /api/admin/tenants/[name]/delete
  * Delete a PiecedTenant CR. The operator handles cleanup
  * (namespace, vault, litellm team, etc.).
+ *
+ * Slice 6: also cascades the tenant_user_assignments rows so a
+ * future tenant with the same name (won't happen given UUID-suffix
+ * naming, but defense in depth) doesn't inherit stale assignments.
+ *
  * Also marks the associated tenant_request as "deleted" so the
  * customer can re-submit the onboarding wizard.
  */
@@ -31,10 +39,14 @@ export async function POST(
   try {
     await deleteTenant(name);
 
-    // Mark the associated tenant_request as "deleted" so the customer
-    // sees the wizard again instead of a stale "active" status
+    // Best-effort DB cleanups. Both errors are logged but not surfaced —
+    // the K8s deletion has already started, and the row state is just
+    // for portal display.
     await markTenantRequestDeletedByTenantName(name).catch((e) =>
-      console.error("Failed to update tenant request after delete:", e)
+      console.error("Failed to mark tenant request deleted:", e)
+    );
+    await removeAllAssignmentsForTenant(name).catch((e) =>
+      console.error("Failed to clean up tenant assignments:", e)
     );
 
     return NextResponse.json({

src/app/api/onboarding/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getSessionUser } from "@/lib/session";
+import { getSessionUser, canMutate } from "@/lib/session";
 import {
   createTenantRequest,
   getTenantRequestById,
@@ -8,8 +8,14 @@ import {
   getMostRecentApprovedRequestForOrg,
 } from "@/lib/db";
 import { getTenant, listTenants } from "@/lib/k8s";
+import {
+  listVisibleTenants,
+  canUserSeeTenant,
+  canSeeInflightRequests,
+} from "@/lib/visibility";
 import { sendAdminNotificationEmail } from "@/lib/email";
 import { encryptSecrets } from "@/lib/crypto";
+import { isPersonalOrgName } from "@/lib/personal-org";
 import type { OnboardingInput, PiecedTenant, TenantRequest } from "@/types";
 import { z } from "zod";
 
@@ -105,10 +111,24 @@ export async function GET(req: NextRequest) {
     if (!user.isPlatform && tr.zitadelOrgId !== user.orgId) {
       return NextResponse.json({ error: "Not found" }, { status: 404 });
     }
+    // Slice 6: a `user`-role customer doesn't see in-flight requests
+    // even within their own org — they can't act on them and showing
+    // the row would be a permanent "pending" state with no exit. Owner
+    // and platform skip this gate.
+    if (!canSeeInflightRequests(user)) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
 
     let tenant: PiecedTenant | null = null;
     if (tr.tenantName) {
       tenant = (await getTenant(tr.tenantName)) ?? null;
+      // If a request is already linked to a tenant CR and the caller
+      // can't see that tenant (assignment scope), don't expose it via
+      // the request endpoint either. canSeeInflightRequests above
+      // already shortcuts this for `user`-role, but defense in depth.
+      if (tenant && !(await canUserSeeTenant(user, tenant))) {
+        return NextResponse.json({ error: "Not found" }, { status: 404 });
+      }
     }
     return NextResponse.json({
       request: publicRequestShape(tr),
@@ -116,19 +136,21 @@ export async function GET(req: NextRequest) {
     });
   }
 
-  // List view: requests + tenants for this org
+  // List view: requests + tenants for this org, filtered by visibility.
+  // For owner/platform, this returns the same data as pre-Slice-6.
+  // For user-role, requests is forced to [] and tenants is narrowed to
+  // assignments.
   const [requests, allTenants] = await Promise.all([
     listActiveTenantRequestsByOrgId(user.orgId),
     listTenants(),
   ]);
 
-  const orgTenants = allTenants.filter(
-    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
-  );
+  const visibleTenants = await listVisibleTenants(user, allTenants);
+  const visibleRequests = canSeeInflightRequests(user) ? requests : [];
 
   return NextResponse.json({
-    requests: requests.map(publicRequestShape),
-    tenants: orgTenants.map(publicTenantShape),
+    requests: visibleRequests.map(publicRequestShape),
+    tenants: visibleTenants.map(publicTenantShape),
   });
 }
 
@@ -156,6 +178,15 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  // Slice 5: only owners (or platform users) may create new instances.
+  // A `user`-role member of an existing org cannot self-provision.
+  if (!canMutate(user)) {
+    return NextResponse.json(
+      { error: "Only the organization owner can create new instances." },
+      { status: 403 }
+    );
+  }
+
   const body = await request.json();
   const parsed = onboardingSchema.safeParse(body);
   if (!parsed.success) {
@@ -176,6 +207,16 @@ export async function POST(request: Request) {
   // company line in favour of the recorded company name.
   const prior = await getMostRecentApprovedRequestForOrg(user.orgId);
 
+  // Slice 4: detect personal-account orgs by the canonical " (Personal)"
+  // suffix on the ZITADEL org name. Set at registration, stable for the
+  // lifetime of the org. Persisted on the row so admin views and the
+  // approve handler don't have to re-derive it.
+  //
+  // If any prior row has is_personal set, prefer that — it's the same
+  // org and the value can't change. (The prior-row check is defensive;
+  // the org-name check should agree.)
+  const isPersonal = prior?.isPersonal ?? isPersonalOrgName(user.orgName);
+
   // Encrypt package secrets if provided
   let encryptedSecrets: Buffer | undefined;
   if (input.packageSecrets && Object.keys(input.packageSecrets).length > 0) {
@@ -212,6 +253,7 @@ export async function POST(request: Request) {
     billingAddress,
     billingNotes,
     encryptedSecrets,
+    isPersonal,
   });
 
   // Notify admin about the new request. For follow-up instances, include

src/app/api/register/route.ts

@@ -5,18 +5,54 @@ import { checkDuplicateDomain } from "@/lib/db";
 import type { RegistrationInput } from "@/types";
 import { z } from "zod";
 
-const registrationSchema = z.object({
-  companyName: z.string().min(2).max(100),
-  givenName: z.string().min(1).max(100),
-  familyName: z.string().min(1).max(100),
-  email: z.string().email(),
-  preferredLanguage: z.enum(["en", "de", "fr", "it"]).optional(),
-});
+/**
+ * Registration schema.
+ *
+ * Slice 4 changes
+ * ---------------
+ * - `companyName` is no longer always required. It's required when
+ *   `isPersonal` is false/absent, ignored when `isPersonal` is true.
+ * - `isPersonal` flag distinguishes personal accounts. The server
+ *   derives the ZITADEL org name from `${givenName} ${familyName}
+ *   (Personal)` for personals — the suffix is the canonical marker
+ *   that downstream code (onboarding POST, admin views) uses to
+ *   distinguish personal orgs from companies. Customers cannot rename
+ *   their own org, so the suffix is stable.
+ * - Personal accounts skip the duplicate-domain check entirely. Their
+ *   row is also excluded from future domain checks (see
+ *   `lib/domain-check.ts::findDuplicateInDb`).
+ */
+const registrationSchema = z
+  .object({
+    companyName: z.string().min(2).max(100).optional(),
+    givenName: z.string().min(1).max(100),
+    familyName: z.string().min(1).max(100),
+    email: z.string().email(),
+    preferredLanguage: z.enum(["en", "de", "fr", "it"]).optional(),
+    isPersonal: z.boolean().optional().default(false),
+  })
+  .refine(
+    (data) =>
+      data.isPersonal || (data.companyName && data.companyName.trim().length >= 2),
+    {
+      message: "Company name is required for company registrations",
+      path: ["companyName"],
+    }
+  );
 
 /** 3 registrations per IP per hour */
 const RATE_LIMIT = 3;
 const RATE_WINDOW_MS = 3_600_000; // 1 hour
 
+/**
+ * Suffix appended to personal-account ZITADEL org names. Used here to
+ * build the org name and elsewhere (session.orgName check) to detect
+ * whether the current user is on a personal org.
+ *
+ * Keep this in sync with `isPersonalOrgName()` in `lib/personal-org.ts`.
+ */
+const PERSONAL_ORG_SUFFIX = " (Personal)";
+
 export async function POST(request: NextRequest) {
   // --- Rate limiting ---
   const ip =
@@ -53,31 +89,45 @@ export async function POST(request: NextRequest) {
     }
 
     const input: RegistrationInput = parsed.data;
+    const isPersonal = input.isPersonal === true;
 
-    // --- Duplicate-domain check ---
+    // --- Duplicate-domain check (skipped for personal accounts) ---
     //
-    // Block if another active tenant_request or ZITADEL org already exists
-    // for this corporate email domain. Public domains (gmail, gmx, etc.)
-    // are exempted by checkDuplicateDomain.
-    //
-    // We return a structured `code: "duplicate_domain"` with the matched
-    // domain so the client can render the localized message via
-    // register.duplicateDomain (with {domain} interpolation). The fallback
-    // English string is included for non-i18n clients (curl, monitoring).
-    const dup = await checkDuplicateDomain(input.email);
-    if (dup.blocked && dup.domain) {
-      return NextResponse.json(
-        {
-          error: `An account for the email domain ${dup.domain} is already registered. Please contact your company administrator or PieCed IT support.`,
-          code: "duplicate_domain",
-          domain: dup.domain,
-        },
-        { status: 409 },
-      );
+    // Personal accounts are explicitly allowed to use any email domain
+    // (including corporate). Their tenant_request rows are excluded
+    // from this check by lib/domain-check.ts, so a personal account
+    // doesn't block a later real-company registration on the same
+    // domain.
+    if (!isPersonal) {
+      const dup = await checkDuplicateDomain(input.email);
+      if (dup.blocked && dup.domain) {
+        return NextResponse.json(
+          {
+            error: `An account for the email domain ${dup.domain} is already registered. Please contact your company administrator or PieCed IT support.`,
+            code: "duplicate_domain",
+            domain: dup.domain,
+          },
+          { status: 409 },
+        );
+      }
     }
 
+    // --- Determine the ZITADEL org name ---
+    //
+    // For company: use the customer-supplied companyName (already
+    //   validated to be present + ≥2 chars by the schema refinement).
+    // For personal: synthesise from full name + " (Personal)" suffix.
+    //   The suffix is the canonical marker for personal orgs.
+    //
+    // ZITADEL does NOT enforce org-name uniqueness, so two "Hans Müller
+    // (Personal)" orgs can coexist; the org id is what matters for our
+    // labelling and lookups, the name is human-readable only.
+    const orgName = isPersonal
+      ? `${input.givenName.trim()} ${input.familyName.trim()}${PERSONAL_ORG_SUFFIX}`
+      : input.companyName!.trim();
+
     const result = await registerCustomer({
-      companyName: input.companyName,
+      companyName: orgName,
       email: input.email,
       givenName: input.givenName,
       familyName: input.familyName,
@@ -88,6 +138,7 @@ export async function POST(request: NextRequest) {
       {
         orgId: result.orgId,
         userId: result.userId,
+        isPersonal,
         message:
           "Registration successful. You will receive an invitation email to set your password.",
       },

src/app/api/team/invite/route.ts

@@ -0,0 +1,95 @@
+import { NextResponse } from "next/server";
+import { getSessionUser, canMutate } from "@/lib/session";
+import { inviteOrgMember, isValidInviteRole } from "@/lib/team";
+import { z } from "zod";
+import { safeError } from "@/lib/errors";
+
+const inviteSchema = z.object({
+  email: z.string().email(),
+  givenName: z.string().min(1).max(100),
+  familyName: z.string().min(1).max(100),
+  role: z.enum(["owner", "user"]),
+  preferredLanguage: z.enum(["en", "de", "fr", "it"]).optional(),
+});
+
+/**
+ * POST /api/team/invite
+ *
+ * Invite a new member into the caller's org. Body shape:
+ *   { email, givenName, familyName, role: "owner" | "user" }
+ *
+ * Allowed roles are explicitly only the customer-side ones —
+ * `isValidInviteRole` enforces this server-side too as a belt
+ * alongside the Zod enum (the Zod enum is the primary check; the
+ * helper exists because future callers in admin tooling may want the
+ * same predicate).
+ *
+ * Platform users can also call this — they'd be inviting members
+ * into their own platform org, which is uncommon but legal.
+ */
+export async function POST(req: Request) {
+  const user = await getSessionUser();
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!canMutate(user)) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const body = await req.json().catch(() => null);
+  const parsed = inviteSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid input", details: parsed.error.flatten() },
+      { status: 400 }
+    );
+  }
+  const input = parsed.data;
+
+  // Defensive recheck — the Zod enum already guarantees this, but it
+  // makes the intent explicit at the call site.
+  if (!isValidInviteRole(input.role)) {
+    return NextResponse.json(
+      { error: "Role must be 'owner' or 'user'." },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const result = await inviteOrgMember({
+      orgId: user.orgId,
+      email: input.email,
+      givenName: input.givenName,
+      familyName: input.familyName,
+      role: input.role,
+      preferredLanguage: input.preferredLanguage,
+    });
+    return NextResponse.json(
+      {
+        userId: result.userId,
+        message:
+          "Invitation sent. The user will receive an email with a link to set their password.",
+      },
+      { status: 201 }
+    );
+  } catch (e: any) {
+    console.error("Invite failed:", e);
+    // ZITADEL "user already exists" surfaces as a 4xx error; pass it
+    // through with a clean message so the client can render localized
+    // text.
+    const msg = e?.message ?? "";
+    if (msg.includes("already exists") || msg.includes("9.User.AlreadyExisting")) {
+      return NextResponse.json(
+        {
+          error: "A user with this email already exists.",
+          code: "user_already_exists",
+        },
+        { status: 409 }
+      );
+    }
+    return NextResponse.json(
+      { error: safeError(e, "Failed to invite user") },
+      { status: e.statusCode || 500 }
+    );
+  }
+}

src/app/api/team/route.ts

@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+import { getSessionUser, canMutate } from "@/lib/session";
+import { getOrgMembers } from "@/lib/team";
+import { safeError } from "@/lib/errors";
+
+/**
+ * GET /api/team
+ *
+ * Returns the joined members-with-roles view for the caller's org.
+ * Gated on `canMutate` — only owners and platform users can see the
+ * full member list. A `user`-role member shouldn't be browsing the
+ * roster.
+ *
+ * Platform admins viewing this endpoint see members of their OWN
+ * platform org. To inspect customer org membership cross-cut, use
+ * ZITADEL Console — that's the deliberate boundary between portal
+ * (customer self-service) and console (full IAM).
+ */
+export async function GET() {
+  const user = await getSessionUser();
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!canMutate(user)) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  try {
+    const members = await getOrgMembers(user.orgId);
+    return NextResponse.json({ members });
+  } catch (e: any) {
+    console.error("Failed to list team members:", e);
+    return NextResponse.json(
+      { error: safeError(e, "Failed to list team members") },
+      { status: 500 }
+    );
+  }
+}

src/app/api/tenants/[name]/assignments/[userId]/route.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSessionUser, canMutate } from "@/lib/session";
+import { getTenant } from "@/lib/k8s";
+import { removeTenantAssignment } from "@/lib/db";
+import { safeError } from "@/lib/errors";
+
+/**
+ * DELETE /api/tenants/[name]/assignments/[userId]
+ *
+ * Revoke a user's assignment to a tenant. Owner+platform only.
+ *
+ * No-op if the assignment didn't exist (delete is idempotent at the
+ * DB layer). We don't surface "not found" because that would let a
+ * caller probe for assignment existence — the boolean response is
+ * just "you're authorized to do this".
+ *
+ * Note on self-revocation: an owner can revoke their own row even
+ * though it has no practical effect (owners see all tenants). A
+ * `user`-role member cannot revoke their own assignment because
+ * they're already gated out by canMutate.
+ */
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ name: string; userId: string }> }
+) {
+  const user = await getSessionUser();
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!canMutate(user)) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const { name, userId } = await params;
+
+  const tenant = await getTenant(name);
+  if (!tenant) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  // Same cross-org boundary as assign: customer owners can only manage
+  // their own org's tenants; platform users can manage anywhere.
+  const tenantOrgId = tenant.metadata.labels?.["pieced.ch/zitadel-org-id"];
+  if (!user.isPlatform && tenantOrgId !== user.orgId) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  try {
+    await removeTenantAssignment(name, userId);
+    return NextResponse.json({ message: "Assignment revoked." });
+  } catch (e: any) {
+    console.error("Failed to remove tenant assignment:", e);
+    return NextResponse.json(
+      { error: safeError(e, "Failed to revoke assignment") },
+      { status: 500 }
+    );
+  }
+}

src/app/api/tenants/[name]/assignments/route.ts

@@ -0,0 +1,176 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSessionUser, canMutate } from "@/lib/session";
+import { canUserSeeTenant } from "@/lib/visibility";
+import { getTenant } from "@/lib/k8s";
+import {
+  listAssignmentsForTenant,
+  addTenantAssignment,
+} from "@/lib/db";
+import { getOrgMembers } from "@/lib/team";
+import { safeError } from "@/lib/errors";
+import { z } from "zod";
+
+const assignSchema = z.object({
+  userId: z.string().min(1).max(200),
+});
+
+/**
+ * GET /api/tenants/[name]/assignments
+ *
+ * Returns the list of users assigned to a tenant, joined with their
+ * ZITADEL profile (display name, email, role) so the UI can render
+ * a useful list without an extra round-trip.
+ *
+ * Visibility: any caller who can see the tenant can see its
+ * assignments. This includes user-role members who are themselves
+ * assigned — they see their fellow assignees, which is intentional
+ * (so they know who else has access).
+ */
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ name: string }> }
+) {
+  const user = await getSessionUser();
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const { name } = await params;
+
+  const tenant = await getTenant(name);
+  if (!tenant) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  if (!(await canUserSeeTenant(user, tenant))) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  try {
+    const orgId = tenant.metadata.labels?.["pieced.ch/zitadel-org-id"];
+    const [rows, members] = await Promise.all([
+      listAssignmentsForTenant(name),
+      orgId ? getOrgMembers(orgId) : Promise.resolve([]),
+    ]);
+
+    const memberById = new Map(members.map((m) => [m.userId, m]));
+
+    // Enrich assignments with member metadata. If the member can't be
+    // found in ZITADEL (stale row, e.g. user was removed from the org
+    // outside the portal), surface the orphan with a placeholder name
+    // so admins can clean it up.
+    const assignments = rows.map((r) => {
+      const m = memberById.get(r.zitadelUserId);
+      return {
+        userId: r.zitadelUserId,
+        displayName: m?.displayName ?? "(removed user)",
+        email: m?.email ?? "",
+        roles: m?.roles ?? [],
+        assignedAt: r.assignedAt,
+        assignedBy: r.assignedBy,
+        orphan: !m,
+      };
+    });
+
+    return NextResponse.json({ assignments });
+  } catch (e: any) {
+    console.error("Failed to list tenant assignments:", e);
+    return NextResponse.json(
+      { error: safeError(e, "Failed to list assignments") },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * POST /api/tenants/[name]/assignments
+ *
+ * Body: { userId }
+ *
+ * Assign a user to a tenant. Owner+platform only. The target user must
+ * already be a member of the tenant's org (we verify via the team list)
+ * — to add a brand-new user, the owner first invites them via
+ * POST /api/team/invite, then assigns them here.
+ *
+ * Idempotent: re-assigning is a no-op (DB INSERT ... ON CONFLICT DO
+ * NOTHING). The original `assignedAt`/`assignedBy` are preserved.
+ *
+ * Owners technically don't need to be assigned (they see all of their
+ * org's tenants anyway) but we don't reject the operation — just lets
+ * future bookkeeping work consistently.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ name: string }> }
+) {
+  const user = await getSessionUser();
+  if (!user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!canMutate(user)) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const { name } = await params;
+
+  const tenant = await getTenant(name);
+  if (!tenant) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  // Customer owners can only assign within their own org. Platform
+  // users can assign anywhere (rare, but consistent with admin scope).
+  const tenantOrgId = tenant.metadata.labels?.["pieced.ch/zitadel-org-id"];
+  if (!user.isPlatform && tenantOrgId !== user.orgId) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  if (!tenantOrgId) {
+    return NextResponse.json(
+      { error: "Tenant is missing the org-id label; cannot assign." },
+      { status: 500 }
+    );
+  }
+
+  const body = await req.json().catch(() => null);
+  const parsed = assignSchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Invalid input", details: parsed.error.flatten() },
+      { status: 400 }
+    );
+  }
+
+  // Verify the target user is actually a member of the tenant's org.
+  // This is the audit boundary — without it, an owner could grant
+  // access to arbitrary user IDs they made up.
+  try {
+    const members = await getOrgMembers(tenantOrgId);
+    const target = members.find((m) => m.userId === parsed.data.userId);
+    if (!target) {
+      return NextResponse.json(
+        {
+          error:
+            "Target user is not a member of this organization. Invite them first.",
+          code: "user_not_in_org",
+        },
+        { status: 400 }
+      );
+    }
+
+    await addTenantAssignment({
+      tenantName: name,
+      orgId: tenantOrgId,
+      userId: parsed.data.userId,
+      assignedBy: user.id,
+    });
+
+    return NextResponse.json(
+      { message: "User assigned.", userId: parsed.data.userId },
+      { status: 201 }
+    );
+  } catch (e: any) {
+    console.error("Failed to add tenant assignment:", e);
+    return NextResponse.json(
+      { error: safeError(e, "Failed to assign user") },
+      { status: 500 }
+    );
+  }
+}

src/app/api/tenants/[name]/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getSessionUser } from "@/lib/session";
+import { getSessionUser, canMutate } from "@/lib/session";
+import { canUserSeeTenant } from "@/lib/visibility";
 import { getTenant, patchTenantSpec } from "@/lib/k8s";
 import { getPackageDef } from "@/lib/packages";
 import { safeError } from "@/lib/errors";
@@ -22,11 +23,11 @@ export async function GET(
     if (!tenant)
       return NextResponse.json({ error: "Not found" }, { status: 404 });
 
-    if (
-      !user.isPlatform &&
-      tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] !== user.orgId
-    ) {
-      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    // Slice 6: visibility now includes assignment-table check for
+    // user-role members. We return 404 (not 403) to avoid leaking
+    // tenant existence — same as cross-org reads.
+    if (!(await canUserSeeTenant(user, tenant))) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
     }
 
     return NextResponse.json(tenant);
@@ -46,7 +47,7 @@ export async function PATCH(
   if (!user)
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
 
-  if (!user.isPlatform && !user.roles.includes("owner")) {
+  if (!canMutate(user)) {
     return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   }
 

src/app/api/tenants/[name]/secrets/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { getSessionUser } from "@/lib/session";
+import { getSessionUser, canMutate } from "@/lib/session";
 import { getTenant } from "@/lib/k8s";
 import { writePackageSecrets } from "@/lib/openbao";
 import { getPackageDef } from "@/lib/packages";
@@ -12,7 +12,7 @@ export async function POST(
   if (!user)
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
 
-  if (!user.isPlatform && !user.roles.includes("owner")) {
+  if (!canMutate(user)) {
     return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   }
 

src/app/api/tenants/route.ts

@@ -1,21 +1,14 @@
 import { NextResponse } from "next/server";
 import { getSessionUser } from "@/lib/session";
 import { listTenants } from "@/lib/k8s";
+import { listVisibleTenants } from "@/lib/visibility";
 
 export async function GET() {
   const user = await getSessionUser();
   if (!user)
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
 
-  const tenants = await listTenants();
-
-  if (user.isPlatform) {
-    return NextResponse.json(tenants);
-  }
-
-  // Customers see only their own tenant
-  const own = tenants.filter(
-    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
-  );
-  return NextResponse.json(own);
+  const all = await listTenants();
+  const visible = await listVisibleTenants(user, all);
+  return NextResponse.json(visible);
 }

src/app/api/usage/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getSessionUser } from "@/lib/session";
 import { listTenants } from "@/lib/k8s";
+import { listVisibleTenants } from "@/lib/visibility";
 import { getTeamInfo, getTeamSpendLogsV2 } from "@/lib/litellm";
 import { safeError } from "@/lib/errors";
 
@@ -36,12 +37,17 @@ export async function GET(req: NextRequest) {
     keyAlias = req.nextUrl.searchParams.get("keyAlias") ?? null;
   }
 
-  // For customers (or admins without explicit params): resolve from their tenant.
+  // For customers (or admins without explicit params): resolve from
+  // the user's *visible* tenants. With Slice 6, a `user`-role member
+  // can only see usage for tenants they're assigned to — a non-assigned
+  // user defaults to "no active tenant" (404).
+  //
+  // Owner and platform get the full org-scoped list and pick the first
+  // tenant, matching the dashboard's "current instance" semantics.
   if (!teamId) {
-    const tenants = await listTenants();
-    const orgTenant = tenants.find(
-      (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
-    );
+    const allTenants = await listTenants();
+    const visible = await listVisibleTenants(user, allTenants);
+    const orgTenant = visible.find((t) => !!t.status?.litellmTeamId);
 
     if (!orgTenant?.status?.litellmTeamId) {
       return NextResponse.json(

src/components/channel-users/channel-users.tsx

@@ -17,12 +17,15 @@ interface ChannelUsersProps {
   enabledChannels: string[];
   /** Current channelUsers from the PiecedTenant spec */
   initialChannelUsers: Record<string, string[]>;
+  /** Slice 5: when false, add inputs and remove ✕ buttons are hidden. */
+  canEdit?: boolean;
 }
 
 export function ChannelUsers({
   tenantName,
   enabledChannels,
   initialChannelUsers,
+  canEdit = true,
 }: ChannelUsersProps) {
   const t = useTranslations("channelUsers");
   const router = useRouter();
@@ -146,44 +149,48 @@ export function ChannelUsers({
                     className="inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-mono bg-accent/10 text-accent border border-accent/20 rounded-full"
                   >
                     {userId}
-                    <button
-                      onClick={() => handleRemove(channel, userId)}
-                      disabled={saving}
-                      className="text-accent/60 hover:text-red-400 transition-colors disabled:opacity-50"
-                      title={t("remove")}
-                    >
-                      ✕
-                    </button>
+                    {canEdit && (
+                      <button
+                        onClick={() => handleRemove(channel, userId)}
+                        disabled={saving}
+                        className="text-accent/60 hover:text-red-400 transition-colors disabled:opacity-50"
+                        title={t("remove")}
+                      >
+                        ✕
+                      </button>
+                    )}
                   </span>
                 ))}
               </div>
             )}
 
-            {/* Add user */}
-            <div className="flex gap-2">
-              <input
-                type="text"
-                value={inputValues[channel] || ""}
-                onChange={(e) =>
-                  setInputValues((prev) => ({
-                    ...prev,
-                    [channel]: e.target.value,
-                  }))
-                }
-                onKeyDown={(e) => {
-                  if (e.key === "Enter") handleAdd(channel);
-                }}
-                placeholder={t("placeholder")}
-                className="flex-1 px-3 py-2 bg-surface-1 border border-border rounded-lg text-sm text-text-primary font-mono placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
-              />
-              <button
-                onClick={() => handleAdd(channel)}
-                disabled={saving || !inputValues[channel]?.trim()}
-                className="px-4 py-2 text-sm font-medium bg-accent text-white rounded-lg hover:bg-accent-dim transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-              >
-                {saving ? "…" : t("add")}
-              </button>
-            </div>
+            {/* Add user — hidden in read-only mode */}
+            {canEdit && (
+              <div className="flex gap-2">
+                <input
+                  type="text"
+                  value={inputValues[channel] || ""}
+                  onChange={(e) =>
+                    setInputValues((prev) => ({
+                      ...prev,
+                      [channel]: e.target.value,
+                    }))
+                  }
+                  onKeyDown={(e) => {
+                    if (e.key === "Enter") handleAdd(channel);
+                  }}
+                  placeholder={t("placeholder")}
+                  className="flex-1 px-3 py-2 bg-surface-1 border border-border rounded-lg text-sm text-text-primary font-mono placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+                />
+                <button
+                  onClick={() => handleAdd(channel)}
+                  disabled={saving || !inputValues[channel]?.trim()}
+                  className="px-4 py-2 text-sm font-medium bg-accent text-white rounded-lg hover:bg-accent-dim transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                >
+                  {saving ? "…" : t("add")}
+                </button>
+              </div>
+            )}
           </div>
         );
       })}

src/components/layout/nav-shell.tsx

@@ -40,6 +40,17 @@ function NavBar() {
             <NavLink href="/dashboard" active={pathname === "/dashboard"}>
               {t("dashboard")}
             </NavLink>
+            {/* Slice 7: /team is owner+platform only. Match server-side
+                gate (canMutate). The roles array carries either "owner"
+                or "user" for customer sessions; isPlatform covers the
+                platform side. */}
+            {user &&
+              (user.isPlatform ||
+                (Array.isArray(user.roles) && user.roles.includes("owner"))) && (
+                <NavLink href="/team" active={pathname === "/team"}>
+                  {t("team")}
+                </NavLink>
+              )}
             {user?.isPlatform && (
               <NavLink href="/admin" active={pathname === "/admin"}>
                 {t("admin")}

src/components/onboarding/wizard.tsx

@@ -4,6 +4,7 @@ import { useState, useCallback, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
 import { Card } from "@/components/ui/card";
 import { PACKAGE_CATALOG, type PackageDef } from "@/lib/packages";
+import { isPersonalOrgName, PERSONAL_ORG_SUFFIX } from "@/lib/personal-org";
 
 type Step = "welcome" | "configure" | "billing" | "confirm";
 
@@ -55,6 +56,16 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
   const tPkg = useTranslations("packages");
   const tCommon = useTranslations("common");
 
+  // Slice 4: personal accounts have an org name of the form
+  // "{givenName} {familyName} (Personal)". For SOUL.md and the billing
+  // company line, strip the suffix so the visible string is the user's
+  // actual name (no stray "(Personal)" leaking onto invoices or into
+  // the assistant's prompt).
+  const isPersonal = isPersonalOrgName(orgName);
+  const displayOrgName = isPersonal
+    ? orgName.slice(0, -PERSONAL_ORG_SUFFIX.length).trim()
+    : orgName;
+
   const [step, setStep] = useState<Step>("welcome");
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState("");
@@ -64,11 +75,14 @@ export function OnboardingWizard({ orgName, onComplete }: WizardProps) {
   const [config, setConfig] = useState({
     instanceName: "",
     agentName: "Assistant",
-    soulMd: FALLBACK_SOUL.replace("{company}", orgName),
+    soulMd: FALLBACK_SOUL.replace("{company}", displayOrgName),
     agentsMd: FALLBACK_AGENTS,
     packages: [] as string[],
     billingAddress: {
-      company: orgName,
+      // For personal accounts, leave the company field empty — it'll
+      // appear on invoices. The user can still type something if they
+      // want to.
+      company: isPersonal ? "" : displayOrgName,
       street: "",
       city: "",
       postalCode: "",

src/components/packages/package-card.tsx

@@ -10,9 +10,18 @@ interface Props {
   status?: "pending" | "active" | "error";
   tenantName: string;
   onToggled: () => void;
+  /** Slice 5: when false, the enable/disable button is hidden. */
+  canEdit?: boolean;
 }
 
-export function PackageCard({ pkg, enabled, status, tenantName, onToggled }: Props) {
+export function PackageCard({
+  pkg,
+  enabled,
+  status,
+  tenantName,
+  onToggled,
+  canEdit = true,
+}: Props) {
   const t = useTranslations();
   const [showModal, setShowModal] = useState(false);
   const [secrets, setSecrets] = useState<Record<string, string>>({});
@@ -113,17 +122,27 @@ export function PackageCard({ pkg, enabled, status, tenantName, onToggled }: Pro
           {pkg.requiresSecrets && (
             <span className="text-[10px] text-text-muted">{t("packages.requiresApiKey")}</span>
           )}
-          <button
-            onClick={enabled ? () => togglePackage(false) : handleEnable}
-            disabled={saving}
-            className={`ml-auto rounded-lg px-3 py-1.5 text-xs font-medium transition-all cursor-pointer ${
-              enabled
-                ? "bg-surface-3 text-text-secondary hover:text-text-primary hover:bg-surface-2"
-                : "bg-accent text-surface-0 hover:bg-accent-dim shadow-lg shadow-accent/20"
-            } disabled:opacity-50`}
-          >
-            {saving ? "…" : enabled ? t("packages.disable") : t("packages.enable")}
-          </button>
+          {canEdit ? (
+            <button
+              onClick={enabled ? () => togglePackage(false) : handleEnable}
+              disabled={saving}
+              className={`ml-auto rounded-lg px-3 py-1.5 text-xs font-medium transition-all cursor-pointer ${
+                enabled
+                  ? "bg-surface-3 text-text-secondary hover:text-text-primary hover:bg-surface-2"
+                  : "bg-accent text-surface-0 hover:bg-accent-dim shadow-lg shadow-accent/20"
+              } disabled:opacity-50`}
+            >
+              {saving ? "…" : enabled ? t("packages.disable") : t("packages.enable")}
+            </button>
+          ) : (
+            // Slice 5: read-only viewers see a static badge instead of a
+            // toggle. The status badge above the divider already conveys
+            // "active/pending/error"; this just clarifies "you can't change
+            // it" without duplicating the status colour.
+            <span className="ml-auto text-[10px] text-text-muted italic">
+              {enabled ? t("packages.statusEnabled") : t("packages.statusDisabled")}
+            </span>
+          )}
         </div>
       </div>
 

src/components/packages/package-list.tsx

@@ -10,6 +10,8 @@ interface Props {
   enabledPackages: string[];
   conditions?: Array<{ type: string; status: string; reason?: string }>;
   onRefresh?: () => void;
+  /** Slice 5: when false, package toggles and edit affordances are hidden. */
+  canEdit?: boolean;
 }
 
 const CATEGORIES = [
@@ -30,7 +32,13 @@ function getPackageStatus(
   return "error";
 }
 
-export function PackageList({ tenantName, enabledPackages, conditions, onRefresh }: Props) {
+export function PackageList({
+  tenantName,
+  enabledPackages,
+  conditions,
+  onRefresh,
+  canEdit = true,
+}: Props) {
   const t = useTranslations("packages");
   const router = useRouter();
   const handleRefresh = onRefresh || (() => router.refresh());
@@ -55,6 +63,7 @@ export function PackageList({ tenantName, enabledPackages, conditions, onRefresh
                   status={getPackageStatus(pkg.id, enabledPackages.includes(pkg.id), conditions)}
                   tenantName={tenantName}
                   onToggled={handleRefresh}
+                  canEdit={canEdit}
                 />
               ))}
             </div>

src/components/packages/workspace-editor.tsx

@@ -8,9 +8,11 @@ const FILE_TABS = ["SOUL.md", "AGENTS.md", "TOOLS.md"] as const;
 interface Props {
   tenantName: string;
   files: Record<string, string>;
+  /** Slice 5: when false, save button hidden and textarea is read-only. */
+  canEdit?: boolean;
 }
 
-export function WorkspaceEditor({ tenantName, files }: Props) {
+export function WorkspaceEditor({ tenantName, files, canEdit = true }: Props) {
   const t = useTranslations("workspace");
   const [activeTab, setActiveTab] = useState<string>("SOUL.md");
   const [localFiles, setLocalFiles] = useState<Record<string, string>>(files);
@@ -19,6 +21,7 @@ export function WorkspaceEditor({ tenantName, files }: Props) {
   const [error, setError] = useState<string | null>(null);
 
   function handleChange(content: string) {
+    if (!canEdit) return;
     setLocalFiles((prev) => ({ ...prev, [activeTab]: content }));
     setDirty(true);
   }
@@ -62,20 +65,25 @@ export function WorkspaceEditor({ tenantName, files }: Props) {
             </button>
           ))}
         </div>
-        <button
-          onClick={handleSave}
-          disabled={!dirty || saving}
-          className="rounded-lg bg-accent px-3 py-1 text-xs font-medium text-surface-0 hover:bg-accent-dim disabled:opacity-40 cursor-pointer"
-        >
-          {saving ? "…" : t("save")}
-        </button>
+        {canEdit && (
+          <button
+            onClick={handleSave}
+            disabled={!dirty || saving}
+            className="rounded-lg bg-accent px-3 py-1 text-xs font-medium text-surface-0 hover:bg-accent-dim disabled:opacity-40 cursor-pointer"
+          >
+            {saving ? "…" : t("save")}
+          </button>
+        )}
       </div>
 
       <textarea
         value={localFiles[activeTab] || ""}
         onChange={(e) => handleChange(e.target.value)}
+        readOnly={!canEdit}
         spellCheck={false}
-        className="w-full min-h-[300px] resize-y bg-transparent p-4 font-mono text-sm text-text-secondary placeholder:text-text-muted focus:outline-none"
+        className={`w-full min-h-[300px] resize-y bg-transparent p-4 font-mono text-sm text-text-secondary placeholder:text-text-muted focus:outline-none ${
+          !canEdit ? "cursor-default" : ""
+        }`}
         placeholder={t("placeholder", { file: activeTab })}
       />
 

src/components/team/invite-form.tsx

@@ -0,0 +1,150 @@
+"use client";
+
+import { useState } from "react";
+import { useTranslations } from "next-intl";
+
+type FormState = "idle" | "submitting" | "success" | "error";
+
+/**
+ * InviteForm — owner submits email + name + role to /api/team/invite.
+ * On success, broadcasts `team:refresh` so the sibling TeamList
+ * re-fetches the member list.
+ *
+ * Form fields mirror the POST body:
+ *   { email, givenName, familyName, role: "owner" | "user" }
+ *
+ * Role defaults to "user" — the more conservative grant. Owner
+ * promotion happens in ZITADEL Console for now.
+ */
+export function InviteForm() {
+  const t = useTranslations("team");
+  const tCommon = useTranslations("common");
+
+  const [form, setForm] = useState({
+    email: "",
+    givenName: "",
+    familyName: "",
+    role: "user" as "owner" | "user",
+  });
+  const [state, setState] = useState<FormState>("idle");
+  const [error, setError] = useState("");
+
+  function handleChange(e: React.ChangeEvent<HTMLInputElement | HTMLSelectElement>) {
+    setForm((prev) => ({ ...prev, [e.target.name]: e.target.value }));
+  }
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setError("");
+    setState("submitting");
+
+    try {
+      const res = await fetch("/api/team/invite", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(form),
+      });
+      if (!res.ok) {
+        const data = await res.json();
+        if (data.code === "user_already_exists") {
+          throw new Error(t("inviteUserExists"));
+        }
+        throw new Error(data.error || "Invite failed");
+      }
+      setState("success");
+      setForm({ email: "", givenName: "", familyName: "", role: "user" });
+      // Tell the TeamList sibling to refresh
+      window.dispatchEvent(new Event("team:refresh"));
+
+      // Auto-clear the success banner after a moment so the form
+      // doesn't permanently look "done"
+      setTimeout(() => setState("idle"), 3500);
+    } catch (err: any) {
+      setError(err.message);
+      setState("error");
+    }
+  }
+
+  return (
+    <form onSubmit={handleSubmit} className="space-y-4">
+      <div className="grid grid-cols-2 gap-3">
+        <div>
+          <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+            {t("givenName")}
+          </label>
+          <input
+            name="givenName"
+            type="text"
+            required
+            value={form.givenName}
+            onChange={handleChange}
+            className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+          />
+        </div>
+        <div>
+          <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+            {t("familyName")}
+          </label>
+          <input
+            name="familyName"
+            type="text"
+            required
+            value={form.familyName}
+            onChange={handleChange}
+            className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+          />
+        </div>
+      </div>
+
+      <div>
+        <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+          {t("email")}
+        </label>
+        <input
+          name="email"
+          type="email"
+          required
+          value={form.email}
+          onChange={handleChange}
+          placeholder="colleague@company.ch"
+          className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+        />
+      </div>
+
+      <div>
+        <label className="block text-xs font-semibold uppercase tracking-wider text-text-muted mb-1.5">
+          {t("role")}
+        </label>
+        <select
+          name="role"
+          value={form.role}
+          onChange={handleChange}
+          className="w-full px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+        >
+          <option value="user">{t("roleUser")}</option>
+          <option value="owner">{t("roleOwner")}</option>
+        </select>
+        <p className="text-xs text-text-muted mt-1">{t("roleHint")}</p>
+      </div>
+
+      {error && (
+        <div className="text-xs text-red-400 bg-red-400/10 border border-red-400/20 rounded-lg px-3 py-2">
+          {error}
+        </div>
+      )}
+      {state === "success" && (
+        <div className="text-xs text-emerald-400 bg-emerald-400/10 border border-emerald-400/20 rounded-lg px-3 py-2">
+          {t("inviteSent")}
+        </div>
+      )}
+
+      <button
+        type="submit"
+        disabled={state === "submitting"}
+        className="w-full py-2.5 px-4 bg-accent text-white text-sm font-medium rounded-lg hover:bg-accent-dim transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+      >
+        {state === "submitting" ? tCommon("loading") : t("inviteButton")}
+      </button>
+    </form>
+  );
+}

src/components/team/team-list.tsx

@@ -0,0 +1,98 @@
+"use client";
+
+import { useState, useEffect } from "react";
+import { useTranslations } from "next-intl";
+
+interface OrgMember {
+  userId: string;
+  email: string;
+  displayName: string;
+  givenName: string;
+  familyName: string;
+  roles: string[];
+}
+
+interface Props {
+  initialMembers: OrgMember[];
+  currentUserId: string;
+}
+
+/**
+ * TeamList — renders the org's members. Refreshes after invites by
+ * polling the API; the InviteForm broadcasts a `team:refresh` window
+ * event after a successful invite so the list updates immediately
+ * rather than waiting for the next reload.
+ */
+export function TeamList({ initialMembers, currentUserId }: Props) {
+  const t = useTranslations("team");
+  const [members, setMembers] = useState<OrgMember[]>(initialMembers);
+
+  useEffect(() => {
+    function refresh() {
+      fetch("/api/team")
+        .then((r) => (r.ok ? r.json() : null))
+        .then((data) => {
+          if (data?.members) setMembers(data.members);
+        })
+        .catch(() => {});
+    }
+    window.addEventListener("team:refresh", refresh);
+    return () => window.removeEventListener("team:refresh", refresh);
+  }, []);
+
+  if (members.length === 0) {
+    return (
+      <div className="text-sm text-text-secondary text-center py-6 border border-border rounded-xl bg-surface-1">
+        {t("noMembers")}
+      </div>
+    );
+  }
+
+  return (
+    <div className="bg-surface-1 border border-border rounded-xl overflow-hidden">
+      <ul className="divide-y divide-border">
+        {members.map((m) => (
+          <li
+            key={m.userId}
+            className="px-5 py-3 flex items-center justify-between gap-4"
+          >
+            <div className="min-w-0">
+              <div className="flex items-center gap-2">
+                <span className="text-sm font-medium text-text-primary truncate">
+                  {m.displayName || m.email}
+                </span>
+                {m.userId === currentUserId && (
+                  <span className="text-[10px] uppercase tracking-wider text-accent">
+                    {t("you")}
+                  </span>
+                )}
+              </div>
+              <div className="text-xs text-text-muted truncate font-mono">
+                {m.email}
+              </div>
+            </div>
+            <div className="flex flex-wrap gap-1.5 justify-end">
+              {m.roles.length === 0 && (
+                <span className="text-[10px] uppercase tracking-wider text-text-muted bg-surface-3 px-2 py-0.5 rounded-full">
+                  {t("noRole")}
+                </span>
+              )}
+              {m.roles.map((r) => (
+                <span
+                  key={r}
+                  className={`text-[10px] uppercase tracking-wider px-2 py-0.5 rounded-full ${
+                    r === "owner"
+                      ? "bg-accent/15 text-accent border border-accent/20"
+                      : "bg-surface-3 text-text-secondary border border-border"
+                  }`}
+                >
+                  {r}
+                </span>
+              ))}
+            </div>
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}

src/components/tenants/assigned-users-panel.tsx

@@ -0,0 +1,231 @@
+"use client";
+
+import { useState, useEffect, useCallback } from "react";
+import { useTranslations } from "next-intl";
+import { Card } from "@/components/ui/card";
+
+interface Assignment {
+  userId: string;
+  displayName: string;
+  email: string;
+  roles: string[];
+  assignedAt: string;
+  assignedBy: string;
+  orphan: boolean;
+}
+
+interface OrgMember {
+  userId: string;
+  email: string;
+  displayName: string;
+  roles: string[];
+}
+
+interface Props {
+  tenantName: string;
+  /**
+   * When false, the panel renders read-only — assignments are visible
+   * but the add-user form and remove ✕ buttons are hidden. Pass
+   * `canEdit` from the parent server component (= canMutate(user)).
+   */
+  canEdit: boolean;
+}
+
+/**
+ * AssignedUsersPanel — manages the tenant_user_assignments rows for
+ * one tenant. Owner sees:
+ *   - List of currently-assigned users with name, email, role, and
+ *     an "X" button to revoke.
+ *   - Dropdown of org members not yet assigned + "Assign" button.
+ *
+ * `user`-role members see the panel read-only (canEdit=false): they
+ * see who else has access to the tenant they're working with, but
+ * can't change anything.
+ */
+export function AssignedUsersPanel({ tenantName, canEdit }: Props) {
+  const t = useTranslations("assignments");
+  const [assignments, setAssignments] = useState<Assignment[] | null>(null);
+  const [members, setMembers] = useState<OrgMember[] | null>(null);
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [pickedUserId, setPickedUserId] = useState("");
+
+  const refresh = useCallback(async () => {
+    setError("");
+    try {
+      const [aRes, mRes] = await Promise.all([
+        fetch(`/api/tenants/${tenantName}/assignments`),
+        canEdit
+          ? fetch(`/api/team`)
+          : Promise.resolve(null),
+      ]);
+      if (!aRes.ok) throw new Error("Failed to load assignments");
+      const aData = await aRes.json();
+      setAssignments(aData.assignments ?? []);
+
+      if (mRes && mRes.ok) {
+        const mData = await mRes.json();
+        setMembers(mData.members ?? []);
+      }
+    } catch (err: any) {
+      setError(err.message);
+    }
+  }, [tenantName, canEdit]);
+
+  useEffect(() => {
+    refresh();
+  }, [refresh]);
+
+  async function handleAssign() {
+    if (!pickedUserId || busy) return;
+    setBusy(true);
+    setError("");
+    try {
+      const res = await fetch(`/api/tenants/${tenantName}/assignments`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ userId: pickedUserId }),
+      });
+      if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.error || "Assign failed");
+      }
+      setPickedUserId("");
+      await refresh();
+    } catch (err: any) {
+      setError(err.message);
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function handleRevoke(userId: string) {
+    if (busy) return;
+    setBusy(true);
+    setError("");
+    try {
+      const res = await fetch(
+        `/api/tenants/${tenantName}/assignments/${encodeURIComponent(userId)}`,
+        { method: "DELETE" }
+      );
+      if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.error || "Revoke failed");
+      }
+      await refresh();
+    } catch (err: any) {
+      setError(err.message);
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  if (assignments === null) {
+    return (
+      <Card>
+        <div className="text-xs text-text-muted">{t("loading")}</div>
+      </Card>
+    );
+  }
+
+  // Compute candidates for the assign dropdown: members of the org
+  // who hold the `user` role (not owners — they have implicit access)
+  // and aren't already assigned.
+  const assignedIds = new Set(assignments.map((a) => a.userId));
+  const candidates = (members ?? []).filter(
+    (m) =>
+      !assignedIds.has(m.userId) &&
+      m.roles.includes("user") &&
+      !m.roles.includes("owner")
+  );
+
+  return (
+    <Card>
+      {error && (
+        <div className="text-xs text-red-400 bg-red-400/10 border border-red-400/20 rounded-lg px-3 py-2 mb-3">
+          {error}
+          <button
+            onClick={() => setError("")}
+            className="ml-2 text-red-300 hover:text-red-200"
+          >
+            ✕
+          </button>
+        </div>
+      )}
+
+      {assignments.length === 0 ? (
+        <p className="text-sm text-text-secondary text-center py-3">
+          {t("noneAssigned")}
+        </p>
+      ) : (
+        <ul className="divide-y divide-border -mx-2">
+          {assignments.map((a) => (
+            <li
+              key={a.userId}
+              className="px-2 py-2 flex items-center justify-between gap-3"
+            >
+              <div className="min-w-0">
+                <div className="text-sm font-medium text-text-primary truncate">
+                  {a.orphan ? (
+                    <span className="text-text-muted italic">
+                      {a.displayName}
+                    </span>
+                  ) : (
+                    a.displayName
+                  )}
+                </div>
+                {a.email && (
+                  <div className="text-xs text-text-muted truncate font-mono">
+                    {a.email}
+                  </div>
+                )}
+              </div>
+              {canEdit && (
+                <button
+                  onClick={() => handleRevoke(a.userId)}
+                  disabled={busy}
+                  className="text-text-muted/60 hover:text-red-400 transition-colors disabled:opacity-50 text-sm px-2"
+                  title={t("revoke")}
+                >
+                  ✕
+                </button>
+              )}
+            </li>
+          ))}
+        </ul>
+      )}
+
+      {canEdit && (
+        <div className="mt-4 pt-4 border-t border-border">
+          {candidates.length === 0 ? (
+            <p className="text-xs text-text-muted text-center py-2">
+              {t("noCandidates")}
+            </p>
+          ) : (
+            <div className="flex gap-2">
+              <select
+                value={pickedUserId}
+                onChange={(e) => setPickedUserId(e.target.value)}
+                className="flex-1 px-3 py-2 bg-surface-2 border border-border rounded-lg text-sm text-text-primary focus:outline-none focus:ring-1 focus:ring-accent focus:border-accent transition-colors"
+              >
+                <option value="">{t("pickUser")}</option>
+                {candidates.map((m) => (
+                  <option key={m.userId} value={m.userId}>
+                    {m.displayName || m.email}
+                  </option>
+                ))}
+              </select>
+              <button
+                onClick={handleAssign}
+                disabled={busy || !pickedUserId}
+                className="px-4 py-2 text-sm font-medium bg-accent text-white rounded-lg hover:bg-accent-dim transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                {busy ? "…" : t("assign")}
+              </button>
+            </div>
+          )}
+        </div>
+      )}
+    </Card>
+  );
+}

src/lib/auth.ts

@@ -1,14 +1,25 @@
 import NextAuth from "next-auth";
 import type { NextAuthConfig } from "next-auth";
-import type { PlatformRole, SessionUser, ZitadelClaims } from "@/types";
+import type { PlatformRole, Role, SessionUser, ZitadelClaims } from "@/types";
 
 const PLATFORM_ROLES: PlatformRole[] = ["platform_admin", "platform_operator"];
 
+/**
+ * Pull the role keys from the ZITADEL `urn:zitadel:iam:org:project:roles`
+ * claim. The claim is shaped as { roleKey: { orgId: orgName } } — we only
+ * need the keys.
+ *
+ * Slice 5: returns Role[] (the union) rather than PlatformRole[]. The
+ * keys can be either platform or customer roles depending on what the
+ * project authorization granted; the SessionUser carries them all and
+ * downstream helpers (canMutate, isCustomerOwner, requirePlatformRole)
+ * decide what each subset means.
+ */
 function extractRoles(
   rolesObj?: Record<string, Record<string, string>>
-): PlatformRole[] {
+): Role[] {
   if (!rolesObj) return [];
-  return Object.keys(rolesObj) as PlatformRole[];
+  return Object.keys(rolesObj) as Role[];
 }
 
 export const authConfig: NextAuthConfig = {
@@ -50,7 +61,7 @@ export const authConfig: NextAuthConfig = {
       return token;
     },
     async session({ session, token }) {
-      const roles = (token.roles as PlatformRole[]) ?? [];
+      const roles = (token.roles as Role[]) ?? [];
       const sessionUser: SessionUser = {
         id: token.sub!,
         name: session.user?.name ?? "",
@@ -58,7 +69,9 @@ export const authConfig: NextAuthConfig = {
         orgId: token.orgId as string,
         orgName: token.orgName as string,
         roles,
-        isPlatform: roles.some((r) => PLATFORM_ROLES.includes(r)),
+        isPlatform: roles.some((r) =>
+          PLATFORM_ROLES.includes(r as PlatformRole)
+        ),
       };
       (session as any).platformUser = sessionUser;
       return session;

src/lib/db.ts

@@ -55,6 +55,7 @@ const MIGRATION_SQL = `
     admin_notes       TEXT,
     tenant_name       TEXT,
     encrypted_secrets BYTEA,
+    is_personal       BOOLEAN NOT NULL DEFAULT FALSE,
     created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
     updated_at        TIMESTAMPTZ NOT NULL DEFAULT now()
   );
@@ -70,6 +71,7 @@ const MIGRATION_SQL = `
   ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS encrypted_secrets BYTEA;
   ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS agents_md TEXT;
   ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS instance_name TEXT;
+  ALTER TABLE tenant_requests ADD COLUMN IF NOT EXISTS is_personal BOOLEAN NOT NULL DEFAULT FALSE;
 
   -- Slice 3: drop the legacy 1-org-1-request constraint if it exists
   ALTER TABLE tenant_requests DROP CONSTRAINT IF EXISTS tenant_requests_zitadel_org_id_key;
@@ -80,6 +82,39 @@ const MIGRATION_SQL = `
     content    TEXT NOT NULL,
     updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
   );
+
+  -- ---------------------------------------------------------------------------
+  -- Slice 6: per-tenant user assignments
+  -- ---------------------------------------------------------------------------
+  --
+  -- Each row grants ONE user visibility into ONE tenant within their own
+  -- ZITADEL org. Used to narrow the customer 'user' role from "everything
+  -- in the org" to "only the tenants I've been assigned to". Owners and
+  -- platform users bypass this table entirely.
+  --
+  -- Composite PK is (tenant_name, zitadel_user_id) — a user is either
+  -- assigned to a tenant or not, no degree.
+  --
+  -- The zitadel_org_id column is denormalised onto every row so cascade
+  -- cleanups when a user leaves an org can be expressed as a single
+  -- DELETE WHERE zitadel_org_id=$1 AND zitadel_user_id=$2 — without
+  -- joining tenant_requests. The assigned_by column tracks which user
+  -- (the owner usually) granted the assignment, for audit.
+  --
+  -- Cascade on tenant deletion is enforced in application code (the
+  -- admin delete handler calls removeAllAssignmentsForTenant) rather
+  -- than via FK — there's no FK target, since K8s CRs aren't a Postgres
+  -- table.
+  CREATE TABLE IF NOT EXISTS tenant_user_assignments (
+    tenant_name      TEXT NOT NULL,
+    zitadel_org_id   TEXT NOT NULL,
+    zitadel_user_id  TEXT NOT NULL,
+    assigned_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    assigned_by      TEXT NOT NULL,
+    PRIMARY KEY (tenant_name, zitadel_user_id)
+  );
+  CREATE INDEX IF NOT EXISTS idx_tua_user ON tenant_user_assignments(zitadel_user_id);
+  CREATE INDEX IF NOT EXISTS idx_tua_org  ON tenant_user_assignments(zitadel_org_id);
 `;
 
 let migrated = false;
@@ -156,8 +191,9 @@ export async function createTenantRequest(
     `INSERT INTO tenant_requests
        (zitadel_org_id, zitadel_user_id, company_name, instance_name,
         contact_name, contact_email, agent_name, soul_md, agents_md,
-        packages, billing_address, billing_notes, encrypted_secrets)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+        packages, billing_address, billing_notes, encrypted_secrets,
+        is_personal)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
      RETURNING *`,
     [
       params.zitadelOrgId,
@@ -173,6 +209,7 @@ export async function createTenantRequest(
       JSON.stringify(params.billingAddress),
       params.billingNotes,
       params.encryptedSecrets ?? null,
+      params.isPersonal ?? false,
     ]
   );
   return mapRow(result.rows[0]);
@@ -408,7 +445,155 @@ function mapRow(row: any): TenantRequest {
     adminNotes: row.admin_notes,
     tenantName: row.tenant_name,
     encryptedSecrets: row.encrypted_secrets ?? null,
+    isPersonal: row.is_personal ?? false,
     createdAt: row.created_at?.toISOString?.() ?? row.created_at,
     updatedAt: row.updated_at?.toISOString?.() ?? row.updated_at,
   };
 }
+
+// ---------------------------------------------------------------------------
+// Slice 6: tenant ↔ user assignments
+// ---------------------------------------------------------------------------
+
+/**
+ * One assignment grants one user visibility into one tenant. Returned
+ * shape is the camelCase mirror of the Postgres row.
+ */
+export interface TenantUserAssignment {
+  tenantName: string;
+  zitadelOrgId: string;
+  zitadelUserId: string;
+  assignedAt: string;
+  assignedBy: string;
+}
+
+function mapAssignmentRow(row: any): TenantUserAssignment {
+  return {
+    tenantName: row.tenant_name,
+    zitadelOrgId: row.zitadel_org_id,
+    zitadelUserId: row.zitadel_user_id,
+    assignedAt: row.assigned_at?.toISOString?.() ?? row.assigned_at,
+    assignedBy: row.assigned_by,
+  };
+}
+
+/**
+ * Returns the set of tenant CR names assigned to the given user.
+ *
+ * Hot path on every read for `user`-role customers, so it's intentionally
+ * a single indexed lookup. The returned array is small (a handful of
+ * tenants per user); callers usually wrap it in a Set.
+ *
+ * Note: this does NOT cross-check the org id — assignments are per-user,
+ * and a user's org context comes from their JWT. If a user's
+ * authorization is revoked at the ZITADEL level, their JWT ceases to
+ * carry the customer role and they can't reach the dashboard at all;
+ * the orphan rows are cleaned up the next time their org membership
+ * is re-evaluated (Slice 7's removeAllAssignmentsForUser).
+ */
+export async function listTenantAssignmentsForUser(
+  userId: string
+): Promise<string[]> {
+  await ensureSchema();
+  const result = await getPool().query<{ tenant_name: string }>(
+    "SELECT tenant_name FROM tenant_user_assignments WHERE zitadel_user_id = $1",
+    [userId]
+  );
+  return result.rows.map((r) => r.tenant_name);
+}
+
+/**
+ * Returns all assignments for a single tenant. Used by the team UI
+ * (Slice 7) to render "who has access to this instance". Includes
+ * `assignedBy` and `assignedAt` for audit display.
+ */
+export async function listAssignmentsForTenant(
+  tenantName: string
+): Promise<TenantUserAssignment[]> {
+  await ensureSchema();
+  const result = await getPool().query(
+    "SELECT * FROM tenant_user_assignments WHERE tenant_name = $1 ORDER BY assigned_at DESC",
+    [tenantName]
+  );
+  return result.rows.map(mapAssignmentRow);
+}
+
+/**
+ * Grant a user access to a tenant. Idempotent — a duplicate INSERT
+ * is silently ignored via ON CONFLICT, and the existing
+ * `assigned_at`/`assigned_by` are preserved (we don't update them on
+ * re-assign).
+ *
+ * Caller is responsible for verifying:
+ *   - The actor (`assignedBy`) holds owner/platform role in `orgId`.
+ *   - The target user (`userId`) is actually a member of the same
+ *     ZITADEL org. We don't validate this here — the team UI fetches
+ *     the org's user list from ZITADEL and selects from it.
+ *   - The tenant CR exists and is labelled with the same `orgId`.
+ */
+export async function addTenantAssignment(params: {
+  tenantName: string;
+  orgId: string;
+  userId: string;
+  assignedBy: string;
+}): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    `INSERT INTO tenant_user_assignments
+       (tenant_name, zitadel_org_id, zitadel_user_id, assigned_by)
+     VALUES ($1, $2, $3, $4)
+     ON CONFLICT (tenant_name, zitadel_user_id) DO NOTHING`,
+    [params.tenantName, params.orgId, params.userId, params.assignedBy]
+  );
+}
+
+/**
+ * Revoke a user's access to a tenant. No-op if the row doesn't exist.
+ */
+export async function removeTenantAssignment(
+  tenantName: string,
+  userId: string
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    "DELETE FROM tenant_user_assignments WHERE tenant_name = $1 AND zitadel_user_id = $2",
+    [tenantName, userId]
+  );
+}
+
+/**
+ * Cascade cleanup: drop ALL assignments for a tenant when the tenant
+ * itself is deleted. Called from the admin delete handler.
+ *
+ * Without this, an orphan row would stick around forever — a future
+ * tenant with the same name (won't happen given Slice 1's UUID-suffix
+ * naming, but defense in depth) would inherit the old assignments.
+ */
+export async function removeAllAssignmentsForTenant(
+  tenantName: string
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    "DELETE FROM tenant_user_assignments WHERE tenant_name = $1",
+    [tenantName]
+  );
+}
+
+/**
+ * Cascade cleanup: drop ALL assignments for a user within a specific
+ * org. Used by Slice 7's "remove member" flow when an owner kicks a
+ * user out of the org. Scoped by `orgId` so a user with assignments in
+ * org A doesn't lose them when removed from org B (multi-org users
+ * exist when a person registers personally and is also invited to a
+ * company).
+ */
+export async function removeAllAssignmentsForUser(
+  orgId: string,
+  userId: string
+): Promise<void> {
+  await ensureSchema();
+  await getPool().query(
+    "DELETE FROM tenant_user_assignments WHERE zitadel_org_id = $1 AND zitadel_user_id = $2",
+    [orgId, userId]
+  );
+}

src/lib/domain-check.ts

@@ -140,6 +140,12 @@ export function isPublicEmailDomain(domain: string): boolean {
  * Look up active tenant_requests whose contact_email shares the given domain.
  * Active = status NOT IN ('rejected', 'deleted').
  *
+ * Slice 4: personal-account rows (is_personal = TRUE) are excluded. A
+ * person's personal account doesn't claim the domain on behalf of a
+ * company — alice@acme.ch registering as a personal account must not
+ * block the actual Acme GmbH from registering later. The personal flag
+ * lives on the row itself, set by /api/register at creation time.
+ *
  * Uses LOWER() on both sides to handle any historical case inconsistency in
  * stored emails. The pattern '%@<domain>' is anchored so 'acme.ch' does not
  * match 'notacme.ch' or 'acme.ch.evil.com'.
@@ -151,7 +157,8 @@ async function findDuplicateInDb(
   const result = await pool.query<{ count: string }>(
     `SELECT COUNT(*) AS count FROM tenant_requests
      WHERE LOWER(contact_email) LIKE $1
-       AND status NOT IN ('rejected', 'deleted')`,
+       AND status NOT IN ('rejected', 'deleted')
+       AND is_personal = FALSE`,
     [`%@${domain.toLowerCase()}`]
   );
   return Number(result.rows[0]?.count ?? 0) > 0;

src/lib/personal-org.ts

@@ -0,0 +1,40 @@
+/**
+ * Personal-account helpers.
+ *
+ * Slice 4 establishes the convention that ZITADEL org names for personal
+ * accounts end with the literal " (Personal)" suffix. This file
+ * centralises the suffix and the predicate so both registration (which
+ * sets the suffix) and onboarding (which reads it from the session) use
+ * the same canonical form.
+ *
+ * Why a name suffix and not ZITADEL org metadata?
+ * -----------------------------------------------
+ * 1. The suffix is visible in ZITADEL Console, admin tools, JWT claims,
+ *    etc. — useful debugging signal at zero cost.
+ * 2. Customers cannot rename their own org (requires IAM_OWNER, which
+ *    only the SA holds), so the suffix is stable for the lifetime of
+ *    the org.
+ * 3. No extra ZITADEL API calls at onboarding time to fetch metadata.
+ * 4. No extra portal DB tables.
+ *
+ * The trade-off: an admin who manually renames a personal org via
+ * ZITADEL Console could remove the suffix, after which onboarding
+ * would treat that org as a company. That's a deliberate destructive
+ * action and the worst outcome is a misnamed K8s CR; nothing breaks.
+ */
+
+export const PERSONAL_ORG_SUFFIX = " (Personal)";
+
+/**
+ * Returns true when the given ZITADEL org name marks a personal account.
+ *
+ * The check is exact-suffix match (after trimming). Whitespace inside
+ * the suffix is significant — `" (personal)"` lowercase or `"(Personal)"`
+ * without the leading space are not matches and not personal orgs.
+ *
+ * Pass `session.orgName` from the SessionUser at the call site.
+ */
+export function isPersonalOrgName(orgName: string | null | undefined): boolean {
+  if (!orgName) return false;
+  return orgName.trimEnd().endsWith(PERSONAL_ORG_SUFFIX);
+}

src/lib/session.ts

@@ -1,19 +1,87 @@
 import { auth } from "@/lib/auth";
 import type { SessionUser } from "@/types";
 
+/**
+ * Read-only session lookup. Returns the SessionUser stashed on the
+ * NextAuth session by `auth.ts::callbacks.session`, or null if there
+ * is no authenticated session.
+ */
 export async function getSessionUser(): Promise<SessionUser | null> {
   const session = await auth();
   return (session as any)?.platformUser ?? null;
 }
 
+/**
+ * Throws if there is no authenticated session. Otherwise returns the
+ * SessionUser. Use at the top of any handler that requires a logged-in
+ * user regardless of role.
+ */
 export async function requireSession(): Promise<SessionUser> {
   const user = await getSessionUser();
   if (!user) throw new Error("Unauthorized");
   return user;
 }
 
+/**
+ * Throws unless the caller has a platform-level role
+ * (platform_admin or platform_operator). Use to gate /api/admin/*
+ * routes — these handle ANY customer's org and must not be accessible
+ * to customer-role users.
+ */
 export async function requirePlatformRole(): Promise<SessionUser> {
   const user = await requireSession();
   if (!user.isPlatform) throw new Error("Forbidden: platform role required");
   return user;
 }
+
+// ---------------------------------------------------------------------------
+// Slice 5: role predicates and gates
+// ---------------------------------------------------------------------------
+//
+// Naming convention: `is*` are pure predicates over a SessionUser,
+// safe to call inline in JSX/server components. `require*` throw on
+// failure and are meant for the top of route handlers.
+
+/**
+ * True when the user is a platform admin/operator OR holds the
+ * `owner` customer role on their org.
+ *
+ * This is the single check for "can mutate". Platform users always
+ * win because they administer all orgs cross-cut. Customer-side, only
+ * `owner` may mutate; `user` (and any future read-only customer role)
+ * cannot.
+ */
+export function canMutate(user: SessionUser): boolean {
+  return user.isPlatform || user.roles.includes("owner");
+}
+
+/**
+ * True when the user holds the customer `owner` role on their org.
+ * Excludes platform users — use {@link canMutate} when both should
+ * be allowed.
+ *
+ * Useful for permissions that are specifically about "this customer's
+ * own owner", e.g. "owner can invite users into their own org" — a
+ * platform user shouldn't be casually inviting users into a customer
+ * org, that's an admin-console action and goes through different
+ * tooling.
+ */
+export function isCustomerOwner(user: SessionUser): boolean {
+  return !user.isPlatform && user.roles.includes("owner");
+}
+
+/**
+ * Throws unless `canMutate(user) === true`. Use at the top of any
+ * mutating customer-side handler.
+ *
+ * The thrown error message is intentionally generic — handlers
+ * should catch and translate to a 403 JSON response so the client
+ * doesn't see a stack trace.
+ */
+export async function requireOwnerRole(): Promise<SessionUser> {
+  const user = await requireSession();
+  if (!canMutate(user)) {
+    throw new Error("Forbidden: owner role required");
+  }
+  return user;
+}

src/lib/team.ts

@@ -0,0 +1,168 @@
+/**
+ * Team management — high-level operations on top of `lib/zitadel.ts`.
+ *
+ * Two responsibilities:
+ *   1. Fetching the joined "members + roles" view for an org, used by
+ *      the /team page and the assigned-users panel.
+ *   2. Inviting a new member end-to-end (create user + send invite +
+ *      assign role) with rollback on partial failure, mirroring
+ *      `registerCustomer` for new orgs.
+ *
+ * Allowed customer roles
+ * ----------------------
+ * Slice 7 reduced scope: invitations may only set the customer roles
+ * `owner` or `user`. Platform roles cannot be granted via the portal —
+ * those are managed in ZITADEL Console with stricter access. The
+ * `viewer` role is gone since Slice 5.
+ */
+
+import {
+  listOrgUsers,
+  listOrgAuthorizations,
+  createHumanUser,
+  createInviteCode,
+  createAuthorization,
+  type OrgUser,
+} from "./zitadel";
+import type { CustomerRole } from "@/types";
+
+const ALLOWED_INVITE_ROLES: CustomerRole[] = ["owner", "user"];
+
+export function isValidInviteRole(role: string): role is CustomerRole {
+  return (ALLOWED_INVITE_ROLES as string[]).includes(role);
+}
+
+export interface OrgMember {
+  userId: string;
+  email: string;
+  displayName: string;
+  givenName: string;
+  familyName: string;
+  /**
+   * Roles held by this member on the org's project grant. Usually a
+   * single-element array (one of "owner" / "user"). Could be empty
+   * if the user exists in the org but has no project authorization
+   * yet — appears as "no role" in the UI.
+   */
+  roles: string[];
+}
+
+/**
+ * Fetch the joined members-with-roles view for an org. Two ZITADEL
+ * calls run in parallel (users + authorizations) then joined in memory.
+ *
+ * If either call fails, returns whatever the other one produced —
+ * users without roles render as "no role" badges; missing users are
+ * just absent. Better degraded than empty.
+ */
+export async function getOrgMembers(orgId: string): Promise<OrgMember[]> {
+  const [users, auths] = await Promise.all([
+    listOrgUsers(orgId),
+    listOrgAuthorizations(orgId),
+  ]);
+
+  // Group authorizations by userId — one user could in principle hold
+  // multiple authorization rows (one per role assigned at different
+  // times). Flatten roleKeys.
+  const rolesByUser = new Map<string, Set<string>>();
+  for (const a of auths) {
+    const set = rolesByUser.get(a.userId) ?? new Set<string>();
+    for (const r of a.roleKeys) set.add(r);
+    rolesByUser.set(a.userId, set);
+  }
+
+  return users.map((u) => ({
+    userId: u.userId,
+    email: u.email,
+    displayName: u.displayName,
+    givenName: u.givenName,
+    familyName: u.familyName,
+    roles: Array.from(rolesByUser.get(u.userId) ?? []),
+  }));
+}
+
+/**
+ * Look up a single org member by userId. Convenience wrapper used to
+ * resolve a userId in an assignment row to a display name. Returns
+ * null if the user no longer exists in the org (stale assignment row).
+ */
+export async function getOrgMember(
+  orgId: string,
+  userId: string
+): Promise<OrgMember | null> {
+  const all = await getOrgMembers(orgId);
+  return all.find((m) => m.userId === userId) ?? null;
+}
+
+export interface InviteResult {
+  userId: string;
+  emailAlreadyExists: boolean;
+}
+
+/**
+ * Invite a new member into an existing customer org.
+ *
+ * Three steps:
+ *   1. createHumanUser  — create the ZITADEL human, no password.
+ *   2. createInviteCode — send the invite email (set password + verify).
+ *   3. createAuthorization — assign the chosen customer role.
+ *
+ * If any step after (1) fails, the user is NOT rolled back. Reasoning:
+ * unlike registration where a half-created org is useless, a
+ * half-invited user can be cleaned up manually in ZITADEL Console and
+ * re-invited. The mid-failure cost of partial state is low; the cost of
+ * a wrong rollback is double-creation on retry. So we surface the
+ * error and let the operator decide.
+ *
+ * The invite-email step is best-effort — if SMTP is misconfigured the
+ * user is created and authorized but no email goes out. Owner can
+ * resend manually from ZITADEL Console.
+ *
+ * Note: ZITADEL rejects creating a user with an email that already
+ * exists in the same instance. The error is surfaced as-is from the
+ * `extractZitadelMessage`-aware caller.
+ */
+export async function inviteOrgMember(params: {
+  orgId: string;
+  email: string;
+  givenName: string;
+  familyName: string;
+  role: CustomerRole;
+  preferredLanguage?: string;
+}): Promise<InviteResult> {
+  // Step 1: create the user
+  const user = await createHumanUser({
+    orgId: params.orgId,
+    email: params.email,
+    givenName: params.givenName,
+    familyName: params.familyName,
+    preferredLanguage: params.preferredLanguage,
+  });
+
+  // Step 2: send invite — best-effort
+  try {
+    await createInviteCode(user.id);
+  } catch (err) {
+    console.warn(
+      `Invite email could not be sent for user ${user.id} (SMTP may not be configured):`,
+      err
+    );
+  }
+
+  // Step 3: assign role
+  await createAuthorization({
+    userId: user.id,
+    organizationId: params.orgId,
+    roleKeys: [params.role],
+  });
+
+  return {
+    userId: user.id,
+    emailAlreadyExists: false,
+  };
+}
+
+/**
+ * Re-export for convenience.
+ */
+export type { OrgUser };

src/lib/visibility.ts

@@ -0,0 +1,127 @@
+/**
+ * Tenant visibility scoping for the customer-facing portal.
+ *
+ * Centralised here so every endpoint that lists or fetches tenants
+ * agrees on the same rules. A bug in any one of those — say, a stale
+ * inline filter that returned org-wide results to a `user`-role member
+ * — would leak siblings' workspace files and channel-user lists.
+ * One source of truth makes the audit easy.
+ *
+ * Visibility model
+ * ----------------
+ *   platform_admin / platform_operator → all tenants in the cluster.
+ *   owner (customer)                   → all tenants in their own org.
+ *   user (customer, no owner role)     → only tenants they've been
+ *                                        assigned to via the
+ *                                        tenant_user_assignments table.
+ *
+ * The narrowing for `user` is what turns the customer role into a
+ * meaningful access boundary. Without it, every member of an org
+ * would see every tenant — fine for a one-team SaaS, broken for a
+ * company with separate Production / Staging / Sales instances where
+ * the Sales team shouldn't see the Production workspace files.
+ *
+ * Owners do NOT get filtered against the assignment table even if
+ * they happen to have rows in it. The owner role beats user-level
+ * scoping — that's the point of being an owner.
+ */
+
+import type { SessionUser, PiecedTenant } from "@/types";
+import { listTenantAssignmentsForUser } from "./db";
+
+/** Internal classifier — "what's this caller's visibility scope?". */
+type Scope = "all" | "org" | "assigned";
+
+function scopeFor(user: SessionUser): Scope {
+  if (user.isPlatform) return "all";
+  if (user.roles.includes("owner")) return "org";
+  return "assigned";
+}
+
+/**
+ * Filter a list of tenants down to what `user` is allowed to see.
+ *
+ * Performs at most one DB query (only when scope is "assigned") and
+ * runs the K8s-side filter in memory. The K8s list is already small
+ * (≤100 tenants at pilot scale) so this is fine; if it grew we'd
+ * push the filter down to the K8s label selector instead.
+ */
+export async function listVisibleTenants(
+  user: SessionUser,
+  all: PiecedTenant[]
+): Promise<PiecedTenant[]> {
+  const scope = scopeFor(user);
+
+  if (scope === "all") return all;
+
+  const orgScoped = all.filter(
+    (t) => t.metadata.labels?.["pieced.ch/zitadel-org-id"] === user.orgId
+  );
+
+  if (scope === "org") return orgScoped;
+
+  // scope === "assigned" — narrow to the user's assignment list
+  const assigned = await listTenantAssignmentsForUser(user.id);
+  if (assigned.length === 0) return [];
+
+  const allowed = new Set(assigned);
+  return orgScoped.filter((t) => allowed.has(t.metadata.name));
+}
+
+/**
+ * Single-tenant predicate. Returns true when `user` may see (and read
+ * from) `tenant`. Mutating endpoints additionally need
+ * `canMutate(user)` from `lib/session.ts` — visibility ≠ permission to
+ * change.
+ *
+ * Returns false (rather than throwing) so handlers can map to the
+ * status code that fits their semantics — usually 404 for read paths
+ * (don't leak existence) and 403 for mutation paths (caller already
+ * knew the tenant existed).
+ */
+export async function canUserSeeTenant(
+  user: SessionUser,
+  tenant: PiecedTenant
+): Promise<boolean> {
+  const scope = scopeFor(user);
+
+  if (scope === "all") return true;
+
+  // org scope and assigned scope both require the tenant to belong
+  // to the user's org — different orgs are never visible.
+  if (tenant.metadata.labels?.["pieced.ch/zitadel-org-id"] !== user.orgId) {
+    return false;
+  }
+
+  if (scope === "org") return true;
+
+  // scope === "assigned"
+  const assigned = await listTenantAssignmentsForUser(user.id);
+  return assigned.includes(tenant.metadata.name);
+}
+
+/**
+ * "Should `user` see in-flight tenant requests on the dashboard?"
+ *
+ * Owners and platform users yes (they own the lifecycle); user-role
+ * members no (they can't act on requests, and a request that isn't
+ * yet a tenant has no assignment yet, so showing it would be a
+ * permanent "pending" with no action they can take).
+ */
+export function canSeeInflightRequests(user: SessionUser): boolean {
+  return scopeFor(user) !== "assigned";
+}
+
+/**
+ * Convenience predicate used by client-side empty states. For
+ * `user`-role members, the dashboard wants to distinguish between
+ * "your org has no instances" (very rare; ask owner to set one up)
+ * and "your org has instances but you're not assigned to any" (more
+ * common; ask owner to grant access).
+ *
+ * Callers compute this off the difference between visible and
+ * org-wide tenant lists; this helper just reifies the test.
+ */
+export function isUserScoped(user: SessionUser): boolean {
+  return scopeFor(user) === "assigned";
+}

src/lib/zitadel.ts

@@ -213,6 +213,143 @@ export async function deleteOrganization(orgId: string): Promise<void> {
   await zitadelFetch(`/v2/organizations/${orgId}`, "DELETE");
 }
 
+// ---------------------------------------------------------------------------
+// Slice 7: search/list APIs for team management
+// ---------------------------------------------------------------------------
+//
+// Two endpoints used by the Team UI:
+//   - listOrgUsers       → POST /v2/users   (search with organizationIdQuery)
+//   - listOrgAuthorizations → Connect RPC to AuthorizationService.ListAuthorizations
+//
+// Caveats
+// -------
+// ZITADEL's v2 API surface evolves; the request/response shapes below were
+// written against the v2 schema as documented at the time of authoring
+// (organizationIdQuery filter on UserService.SearchUsers; ListAuthorizations
+// with a ListQuery + filter pair). If your installed ZITADEL version uses
+// slightly different field names, parsing here is intentionally tolerant —
+// the helpers return [] rather than throwing on shape drift, log a warning,
+// and the caller's UI shows an empty team list (which is recoverable).
+//
+// If you find a discrepancy, fix the request shape here and re-deploy; the
+// rest of the team UI doesn't care about the on-the-wire format.
+
+export interface OrgUser {
+  userId: string;
+  email: string;
+  givenName: string;
+  familyName: string;
+  displayName: string;
+}
+
+/**
+ * List all users belonging to a given ZITADEL organization. Paginated;
+ * we cap at 200 per call which is generous for the pilot scale.
+ */
+export async function listOrgUsers(orgId: string): Promise<OrgUser[]> {
+  try {
+    const data = await zitadelFetch<{ result?: any[] }>(
+      "/v2/users",
+      "POST",
+      {
+        queries: [{ organizationIdQuery: { organizationId: orgId } }],
+        // Sort by username so the team list is deterministic across reloads
+        sortingColumn: "USER_FIELD_NAME_USERNAME",
+        query: { limit: 200, asc: true },
+      }
+    );
+    if (!data?.result || !Array.isArray(data.result)) return [];
+
+    return data.result.flatMap((row: any) => {
+      // ZITADEL distinguishes human and machine users; we only want humans.
+      const human = row?.human;
+      if (!human) return [];
+      const profile = human.profile ?? {};
+      const email = human.email?.email ?? "";
+      const userId = row.userId ?? row.id ?? "";
+      if (!userId) return [];
+      return [
+        {
+          userId,
+          email,
+          givenName: profile.givenName ?? "",
+          familyName: profile.familyName ?? "",
+          displayName:
+            profile.displayName ??
+            `${profile.givenName ?? ""} ${profile.familyName ?? ""}`.trim() ??
+            email,
+        } as OrgUser,
+      ];
+    });
+  } catch (err) {
+    console.warn(
+      `Failed to list users for org ${orgId} (returning empty):`,
+      err
+    );
+    return [];
+  }
+}
+
+export interface OrgAuthorization {
+  authorizationId: string;
+  userId: string;
+  organizationId: string;
+  projectId: string;
+  roleKeys: string[];
+}
+
+/**
+ * List authorizations for the OpenClaw Platform project, filtered to a
+ * single organization. Used by the team UI to render each member's
+ * effective role.
+ *
+ * Connect RPC: zitadel.authorization.v2.AuthorizationService/ListAuthorizations
+ *
+ * Returns [] on any error so the team page can render a degraded view
+ * (members visible, roles blank) rather than blowing up entirely.
+ */
+export async function listOrgAuthorizations(
+  orgId: string
+): Promise<OrgAuthorization[]> {
+  try {
+    const data = await connectRpc<{ authorizations?: any[] }>(
+      "zitadel.authorization.v2.AuthorizationService",
+      "ListAuthorizations",
+      {
+        filters: [
+          { organizationId: orgId },
+          { projectId: ZITADEL_PROJECT_ID },
+        ],
+        // Cap at 500 — far more than a pilot org should ever need
+        pagination: { limit: 500 },
+      }
+    );
+    if (!data?.authorizations || !Array.isArray(data.authorizations)) {
+      return [];
+    }
+
+    return data.authorizations.flatMap((row: any) => {
+      const userId = row?.userId ?? "";
+      if (!userId) return [];
+      return [
+        {
+          authorizationId: row.id ?? row.authorizationId ?? "",
+          userId,
+          organizationId: row.organizationId ?? orgId,
+          projectId: row.projectId ?? ZITADEL_PROJECT_ID,
+          roleKeys: Array.isArray(row.roleKeys) ? row.roleKeys : [],
+        } as OrgAuthorization,
+      ];
+    });
+  } catch (err) {
+    console.warn(
+      `Failed to list authorizations for org ${orgId} (returning empty):`,
+      err
+    );
+    return [];
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Full registration flow
 // ---------------------------------------------------------------------------

src/messages/de.json

@@ -11,7 +11,8 @@
     "cancel": "Abbrechen",
     "save": "Speichern",
     "error": "Ein Fehler ist aufgetreten",
-    "register": "Registrieren"
+    "register": "Registrieren",
+    "team": "Team"
   },
   "login": {
     "title": "PieCed Portal",
@@ -35,7 +36,9 @@
     "successTitle": "Registrierung eingegangen",
     "successDescription": "Sie erhalten eine Einladungs-E-Mail mit einem Link, um Ihr Passwort festzulegen und Ihre E-Mail-Adresse zu bestätigen. Danach können Sie sich anmelden und Ihren KI-Assistenten einrichten.",
     "goToLogin": "Zur Anmeldung",
-    "duplicateDomain": "Für die E-Mail-Domain {domain} ist bereits ein Konto registriert. Bitte wenden Sie sich an Ihren Firmenadministrator, um eingeladen zu werden, oder kontaktieren Sie den PieCed-IT-Support, falls dies ein Fehler ist."
+    "duplicateDomain": "Für die E-Mail-Domain {domain} ist bereits ein Konto registriert. Bitte wenden Sie sich an Ihren Firmenadministrator, um eingeladen zu werden, oder kontaktieren Sie den PieCed-IT-Support, falls dies ein Fehler ist.",
+    "individualToggle": "Als Privatperson registrieren",
+    "individualHint": "Aktivieren Sie diese Option, wenn Sie sich nicht im Namen eines Unternehmens registrieren. Ihr Konto wird als persönlicher Arbeitsbereich eingerichtet."
   },
   "onboarding": {
     "loading": "Status wird geladen…",
@@ -101,7 +104,12 @@
     "instances": "Ihre Instanzen",
     "inflightRequests": "Laufende Anfragen",
     "createInstance": "Neue Instanz erstellen",
-    "createInstanceDescription": "Eine weitere KI-Assistent-Instanz für Ihre Organisation bereitstellen. Die Anfrage wird von einem Administrator geprüft, bevor die Instanz erstellt wird."
+    "createInstanceDescription": "Eine weitere KI-Assistent-Instanz für Ihre Organisation bereitstellen. Die Anfrage wird von einem Administrator geprüft, bevor die Instanz erstellt wird.",
+    "noAccessNoInstances": "Ihre Organisation hat noch keine Instanzen. Bitte bitten Sie den Eigentümer der Organisation, eine einzurichten.",
+    "noAssignmentsTitle": "Keine Instanzen zugewiesen",
+    "noAssignmentsDescription": "Ihre Organisation verfügt über Instanzen, aber Sie haben keinen Zugriff darauf erhalten. Bitten Sie den Eigentümer Ihrer Organisation, Sie einer Instanz zuzuweisen.",
+    "noInstancesYetTitle": "Noch keine Instanzen",
+    "noInstancesYetDescription": "Ihre Organisation verfügt noch über keine Instanzen. Bitten Sie den Eigentümer Ihrer Organisation, eine einzurichten."
   },
   "tenantDetail": {
     "agent": "Agent",
@@ -109,7 +117,8 @@
     "workspaceFiles": "Workspace-Dateien",
     "notFound": "Tenant nicht gefunden.",
     "usage": "Nutzung & Kosten",
-    "provisioned": "Bereitgestellt"
+    "provisioned": "Bereitgestellt",
+    "assignedUsers": "Zugewiesene Benutzer"
   },
   "usage": {
     "inputTokens": "Input-Tokens",
@@ -177,7 +186,9 @@
     },
     "documentProcessing": {
       "description": "Aktivieren Sie Dokumentenverarbeitung, Zusammenfassung und Extraktion."
-    }
+    },
+    "statusEnabled": "aktiviert",
+    "statusDisabled": "deaktiviert"
   },
   "admin": {
     "title": "Plattform-Admin",
@@ -260,5 +271,32 @@
     "telegramIdHelp": "So finden Sie Ihre Telegram-Benutzer-ID:\n1. Öffnen Sie Telegram und schreiben Sie @userinfobot\n2. Der Bot antwortet sofort mit Ihrer numerischen ID\n3. Geben Sie diese Nummer hier ein",
     "discordIdHelp": "So finden Sie Ihre Discord-Benutzer-ID:\n1. Aktivieren Sie den Entwicklermodus in den Discord-Einstellungen (Erweitert)\n2. Rechtsklick auf Ihren Namen → Benutzer-ID kopieren\n3. Geben Sie diese Nummer hier ein",
     "emailIdHelp": "Geben Sie die E-Mail-Adresse ein, die zur Interaktion mit dem Assistenten autorisiert werden soll."
+  },
+  "team": {
+    "title": "Team",
+    "description": "Verwalten Sie die Mitglieder Ihrer Organisation. Laden Sie Kollegen ein und weisen Sie sie Instanzen zu.",
+    "inviteSectionTitle": "Mitglied einladen",
+    "membersSectionTitle": "Mitglieder",
+    "noMembers": "Noch keine Mitglieder.",
+    "you": "Sie",
+    "noRole": "keine Rolle",
+    "givenName": "Vorname",
+    "familyName": "Nachname",
+    "email": "E-Mail",
+    "role": "Rolle",
+    "roleUser": "Benutzer (nur Lesezugriff, muss Instanzen zugewiesen werden)",
+    "roleOwner": "Eigentümer (Vollzugriff auf alle Instanzen)",
+    "roleHint": "Eigentümer können Instanzen, Abrechnung und Teammitglieder verwalten. Benutzer können nur die ihnen zugewiesenen Instanzen anzeigen.",
+    "inviteButton": "Einladung senden",
+    "inviteSent": "Einladung gesendet. Der Benutzer erhält eine E-Mail mit einem Link zum Festlegen des Passworts.",
+    "inviteUserExists": "Ein Benutzer mit dieser E-Mail-Adresse ist bereits registriert."
+  },
+  "assignments": {
+    "loading": "Zuweisungen werden geladen…",
+    "noneAssigned": "Dieser Instanz sind noch keine Benutzer zugewiesen.",
+    "noCandidates": "Keine Teammitglieder verfügbar zum Zuweisen. Laden Sie zuerst Benutzer auf der Team-Seite ein.",
+    "pickUser": "Benutzer auswählen…",
+    "assign": "Zuweisen",
+    "revoke": "Entfernen"
   }
 }

src/messages/en.json

@@ -11,7 +11,8 @@
     "cancel": "Cancel",
     "save": "Save",
     "error": "An error occurred",
-    "register": "Register"
+    "register": "Register",
+    "team": "Team"
   },
   "login": {
     "title": "PieCed Portal",
@@ -35,7 +36,9 @@
     "successTitle": "Registration received",
     "successDescription": "You will receive an invitation email with a link to set your password and verify your email address. Once completed, you can sign in to set up your AI assistant.",
     "goToLogin": "Go to Sign In",
-    "duplicateDomain": "An account for the email domain {domain} is already registered. Please contact your company administrator to be invited, or reach out to PieCed IT support if you believe this is in error."
+    "duplicateDomain": "An account for the email domain {domain} is already registered. Please contact your company administrator to be invited, or reach out to PieCed IT support if you believe this is in error.",
+    "individualToggle": "Register as an individual",
+    "individualHint": "Tick this if you're not registering on behalf of a company. Your account will be set up as a personal workspace."
   },
   "onboarding": {
     "loading": "Loading status…",
@@ -101,7 +104,12 @@
     "instances": "Your instances",
     "inflightRequests": "In-flight requests",
     "createInstance": "Create new instance",
-    "createInstanceDescription": "Provision an additional AI assistant instance for your organization. The request will be reviewed by an administrator before the instance is created."
+    "createInstanceDescription": "Provision an additional AI assistant instance for your organization. The request will be reviewed by an administrator before the instance is created.",
+    "noAccessNoInstances": "Your organization doesn't have any instances yet. Please ask the organization owner to set one up.",
+    "noAssignmentsTitle": "No instances assigned",
+    "noAssignmentsDescription": "Your organization has instances, but you haven't been granted access to any of them. Please ask your organization owner to assign you to an instance.",
+    "noInstancesYetTitle": "No instances yet",
+    "noInstancesYetDescription": "Your organization doesn't have any instances yet. Please ask your organization owner to set one up."
   },
   "tenantDetail": {
     "agent": "Agent",
@@ -109,7 +117,8 @@
     "workspaceFiles": "Workspace Files",
     "notFound": "Tenant not found.",
     "usage": "Usage & Spend",
-    "provisioned": "Provisioned"
+    "provisioned": "Provisioned",
+    "assignedUsers": "Assigned users"
   },
   "usage": {
     "inputTokens": "Input Tokens",
@@ -177,7 +186,9 @@
     },
     "documentProcessing": {
       "description": "Enable document parsing, summarization, and extraction."
-    }
+    },
+    "statusEnabled": "enabled",
+    "statusDisabled": "disabled"
   },
   "admin": {
     "title": "Platform Admin",
@@ -260,5 +271,32 @@
     "telegramIdHelp": "To find your Telegram user ID:\n1. Open Telegram and message @userinfobot\n2. It instantly replies with your numeric ID\n3. Enter that number here",
     "discordIdHelp": "To find your Discord user ID:\n1. Enable Developer Mode in Discord settings (Advanced)\n2. Right-click your name → Copy User ID\n3. Enter that number here",
     "emailIdHelp": "Enter the email address that should be authorized to interact with the assistant."
+  },
+  "team": {
+    "title": "Team",
+    "description": "Manage members of your organization. Invite colleagues and assign them to instances.",
+    "inviteSectionTitle": "Invite a member",
+    "membersSectionTitle": "Members",
+    "noMembers": "No members yet.",
+    "you": "You",
+    "noRole": "no role",
+    "givenName": "First name",
+    "familyName": "Last name",
+    "email": "Email",
+    "role": "Role",
+    "roleUser": "User (read-only, must be assigned to instances)",
+    "roleOwner": "Owner (full access to all instances)",
+    "roleHint": "Owners can manage instances, billing, and team members. Users can only view instances they've been assigned to.",
+    "inviteButton": "Send invitation",
+    "inviteSent": "Invitation sent. The user will receive an email with a link to set their password.",
+    "inviteUserExists": "A user with this email is already registered."
+  },
+  "assignments": {
+    "loading": "Loading assignments…",
+    "noneAssigned": "No users are assigned to this instance yet.",
+    "noCandidates": "No team members available to assign. Invite users from the Team page first.",
+    "pickUser": "Select a user…",
+    "assign": "Assign",
+    "revoke": "Remove"
   }
 }

src/messages/fr.json

@@ -11,7 +11,8 @@
     "cancel": "Annuler",
     "save": "Enregistrer",
     "error": "Une erreur est survenue",
-    "register": "S'inscrire"
+    "register": "S'inscrire",
+    "team": "Équipe"
   },
   "login": {
     "title": "Portail PieCed",
@@ -35,7 +36,9 @@
     "successTitle": "Inscription reçue",
     "successDescription": "Vous recevrez un e-mail d'invitation avec un lien pour définir votre mot de passe et vérifier votre adresse e-mail. Ensuite, vous pourrez vous connecter et configurer votre assistant IA.",
     "goToLogin": "Aller à la connexion",
-    "duplicateDomain": "Un compte pour le domaine de courriel {domain} est déjà enregistré. Veuillez contacter l'administrateur de votre entreprise pour être invité, ou contactez le support PieCed IT si vous pensez qu'il s'agit d'une erreur."
+    "duplicateDomain": "Un compte pour le domaine de courriel {domain} est déjà enregistré. Veuillez contacter l'administrateur de votre entreprise pour être invité, ou contactez le support PieCed IT si vous pensez qu'il s'agit d'une erreur.",
+    "individualToggle": "S'inscrire en tant que particulier",
+    "individualHint": "Cochez cette case si vous ne vous inscrivez pas au nom d'une entreprise. Votre compte sera configuré comme espace de travail personnel."
   },
   "onboarding": {
     "loading": "Chargement du statut…",
@@ -101,7 +104,12 @@
     "instances": "Vos instances",
     "inflightRequests": "Demandes en cours",
     "createInstance": "Créer une nouvelle instance",
-    "createInstanceDescription": "Provisionner une instance supplémentaire d'assistant IA pour votre organisation. La demande sera examinée par un administrateur avant la création de l'instance."
+    "createInstanceDescription": "Provisionner une instance supplémentaire d'assistant IA pour votre organisation. La demande sera examinée par un administrateur avant la création de l'instance.",
+    "noAccessNoInstances": "Votre organisation n'a pas encore d'instances. Demandez au propriétaire de l'organisation d'en configurer une.",
+    "noAssignmentsTitle": "Aucune instance attribuée",
+    "noAssignmentsDescription": "Votre organisation possède des instances, mais aucun accès ne vous a été accordé. Demandez au propriétaire de votre organisation de vous attribuer une instance.",
+    "noInstancesYetTitle": "Pas encore d'instances",
+    "noInstancesYetDescription": "Votre organisation ne possède pas encore d'instances. Demandez au propriétaire de votre organisation d'en configurer une."
   },
   "tenantDetail": {
     "agent": "Agent",
@@ -109,7 +117,8 @@
     "workspaceFiles": "Fichiers workspace",
     "notFound": "Locataire non trouvé.",
     "usage": "Utilisation et coûts",
-    "provisioned": "Provisionné"
+    "provisioned": "Provisionné",
+    "assignedUsers": "Utilisateurs attribués"
   },
   "usage": {
     "inputTokens": "Tokens d'entrée",
@@ -177,7 +186,9 @@
     },
     "documentProcessing": {
       "description": "Activez l'analyse, le résumé et l'extraction de documents."
-    }
+    },
+    "statusEnabled": "activé",
+    "statusDisabled": "désactivé"
   },
   "admin": {
     "title": "Admin plateforme",
@@ -260,5 +271,32 @@
     "telegramIdHelp": "Pour trouver votre identifiant Telegram :\n1. Ouvrez Telegram et envoyez un message à @userinfobot\n2. Il répond instantanément avec votre identifiant numérique\n3. Entrez ce numéro ici",
     "discordIdHelp": "Pour trouver votre identifiant Discord :\n1. Activez le mode développeur dans les paramètres Discord (Avancé)\n2. Clic droit sur votre nom → Copier l'identifiant\n3. Entrez ce numéro ici",
     "emailIdHelp": "Entrez l'adresse e-mail qui doit être autorisée à interagir avec l'assistant."
+  },
+  "team": {
+    "title": "Équipe",
+    "description": "Gérez les membres de votre organisation. Invitez des collègues et attribuez-leur des instances.",
+    "inviteSectionTitle": "Inviter un membre",
+    "membersSectionTitle": "Membres",
+    "noMembers": "Aucun membre pour l'instant.",
+    "you": "Vous",
+    "noRole": "aucun rôle",
+    "givenName": "Prénom",
+    "familyName": "Nom de famille",
+    "email": "E-mail",
+    "role": "Rôle",
+    "roleUser": "Utilisateur (lecture seule, doit être affecté à des instances)",
+    "roleOwner": "Propriétaire (accès complet à toutes les instances)",
+    "roleHint": "Les propriétaires peuvent gérer les instances, la facturation et les membres de l'équipe. Les utilisateurs ne peuvent voir que les instances qui leur sont attribuées.",
+    "inviteButton": "Envoyer l'invitation",
+    "inviteSent": "Invitation envoyée. L'utilisateur recevra un e-mail avec un lien pour définir son mot de passe.",
+    "inviteUserExists": "Un utilisateur avec cette adresse e-mail est déjà enregistré."
+  },
+  "assignments": {
+    "loading": "Chargement des attributions…",
+    "noneAssigned": "Aucun utilisateur n'est encore attribué à cette instance.",
+    "noCandidates": "Aucun membre de l'équipe disponible pour l'attribution. Invitez d'abord des utilisateurs depuis la page Équipe.",
+    "pickUser": "Sélectionner un utilisateur…",
+    "assign": "Attribuer",
+    "revoke": "Retirer"
   }
 }

src/messages/it.json

@@ -11,7 +11,8 @@
     "cancel": "Annulla",
     "save": "Salva",
     "error": "Si è verificato un errore",
-    "register": "Registrati"
+    "register": "Registrati",
+    "team": "Team"
   },
   "login": {
     "title": "Portale PieCed",
@@ -35,7 +36,9 @@
     "successTitle": "Registrazione ricevuta",
     "successDescription": "Riceverai un'e-mail di invito con un link per impostare la password e verificare il tuo indirizzo e-mail. Dopodiché potrai accedere e configurare il tuo assistente IA.",
     "goToLogin": "Vai all'accesso",
-    "duplicateDomain": "Un account per il dominio e-mail {domain} è già registrato. Contatta l'amministratore della tua azienda per essere invitato, oppure contatta il supporto PieCed IT se ritieni che si tratti di un errore."
+    "duplicateDomain": "Un account per il dominio e-mail {domain} è già registrato. Contatta l'amministratore della tua azienda per essere invitato, oppure contatta il supporto PieCed IT se ritieni che si tratti di un errore.",
+    "individualToggle": "Registrati come privato",
+    "individualHint": "Seleziona questa opzione se non ti stai registrando per conto di un'azienda. Il tuo account sarà configurato come area di lavoro personale."
   },
   "onboarding": {
     "loading": "Caricamento stato…",
@@ -101,7 +104,12 @@
     "instances": "Le tue istanze",
     "inflightRequests": "Richieste in corso",
     "createInstance": "Crea nuova istanza",
-    "createInstanceDescription": "Effettua il provisioning di un'ulteriore istanza dell'assistente IA per la tua organizzazione. La richiesta sarà esaminata da un amministratore prima della creazione dell'istanza."
+    "createInstanceDescription": "Effettua il provisioning di un'ulteriore istanza dell'assistente IA per la tua organizzazione. La richiesta sarà esaminata da un amministratore prima della creazione dell'istanza.",
+    "noAccessNoInstances": "La tua organizzazione non ha ancora istanze. Chiedi al proprietario dell'organizzazione di configurarne una.",
+    "noAssignmentsTitle": "Nessuna istanza assegnata",
+    "noAssignmentsDescription": "La tua organizzazione ha delle istanze, ma non ti è stato concesso l'accesso a nessuna di esse. Chiedi al proprietario della tua organizzazione di assegnarti a un'istanza.",
+    "noInstancesYetTitle": "Nessuna istanza ancora",
+    "noInstancesYetDescription": "La tua organizzazione non ha ancora istanze. Chiedi al proprietario della tua organizzazione di configurarne una."
   },
   "tenantDetail": {
     "agent": "Agente",
@@ -109,7 +117,8 @@
     "workspaceFiles": "File workspace",
     "notFound": "Tenant non trovato.",
     "usage": "Utilizzo e costi",
-    "provisioned": "Attivato"
+    "provisioned": "Attivato",
+    "assignedUsers": "Utenti assegnati"
   },
   "usage": {
     "inputTokens": "Token di input",
@@ -177,7 +186,9 @@
     },
     "documentProcessing": {
       "description": "Attiva l'analisi, il riassunto e l'estrazione di documenti."
-    }
+    },
+    "statusEnabled": "abilitato",
+    "statusDisabled": "disabilitato"
   },
   "admin": {
     "title": "Admin piattaforma",
@@ -260,5 +271,32 @@
     "telegramIdHelp": "Per trovare il tuo ID Telegram:\n1. Apri Telegram e invia un messaggio a @userinfobot\n2. Risponde istantaneamente con il tuo ID numerico\n3. Inserisci quel numero qui",
     "discordIdHelp": "Per trovare il tuo ID Discord:\n1. Attiva la Modalità sviluppatore nelle impostazioni Discord (Avanzate)\n2. Clic destro sul tuo nome → Copia ID utente\n3. Inserisci quel numero qui",
     "emailIdHelp": "Inserisci l'indirizzo e-mail che deve essere autorizzato a interagire con l'assistente."
+  },
+  "team": {
+    "title": "Team",
+    "description": "Gestisci i membri della tua organizzazione. Invita colleghi e assegnali alle istanze.",
+    "inviteSectionTitle": "Invita un membro",
+    "membersSectionTitle": "Membri",
+    "noMembers": "Nessun membro ancora.",
+    "you": "Tu",
+    "noRole": "nessun ruolo",
+    "givenName": "Nome",
+    "familyName": "Cognome",
+    "email": "E-mail",
+    "role": "Ruolo",
+    "roleUser": "Utente (sola lettura, deve essere assegnato a istanze)",
+    "roleOwner": "Proprietario (accesso completo a tutte le istanze)",
+    "roleHint": "I proprietari possono gestire istanze, fatturazione e membri del team. Gli utenti possono solo visualizzare le istanze a loro assegnate.",
+    "inviteButton": "Invia invito",
+    "inviteSent": "Invito inviato. L'utente riceverà un'e-mail con un link per impostare la password.",
+    "inviteUserExists": "Un utente con questa e-mail è già registrato."
+  },
+  "assignments": {
+    "loading": "Caricamento assegnazioni…",
+    "noneAssigned": "Nessun utente è ancora assegnato a questa istanza.",
+    "noCandidates": "Nessun membro del team disponibile per l'assegnazione. Invita prima gli utenti dalla pagina Team.",
+    "pickUser": "Seleziona un utente…",
+    "assign": "Assegna",
+    "revoke": "Rimuovi"
   }
 }

src/types/index.ts

@@ -5,12 +5,39 @@ export interface ZitadelClaims {
   "urn:zitadel:iam:org:project:roles"?: Record<string, Record<string, string>>;
 }
 
-export type PlatformRole =
-  | "platform_admin"
-  | "platform_operator"
-  | "owner"
-  | "user"
-  | "viewer";
+/**
+ * Platform-level roles, granted to PieCed staff only. Hold the IAM-level
+ * authority to administer the entire installation regardless of which
+ * customer org a request lands on.
+ */
+export type PlatformRole = "platform_admin" | "platform_operator";
+
+/**
+ * Customer-level roles, granted by ZITADEL project authorizations on
+ * each customer org's "OpenClaw Platform" project grant.
+ *
+ * Slice 5 dropped the previously-defined `viewer` role. With the portal
+ * acting purely as a control plane (the assistant itself runs at
+ * separate URLs with their own auth), `user` and `viewer` collapsed
+ * to the same surface — read-only access to instance state and usage.
+ *
+ * - `owner` can mutate (packages, workspace files, channel users,
+ *   instance creation, member invites in Slice 7).
+ * - `user` is read-only in the portal. From Slice 6 onwards `user`
+ *   visibility is also narrowed to assigned tenants only.
+ */
+export type CustomerRole = "owner" | "user";
+
+/** Union of all roles a JWT can carry. */
+export type Role = PlatformRole | CustomerRole;
+
+/**
+ * @deprecated Use {@link Role} for the union, or {@link PlatformRole}
+ *             / {@link CustomerRole} when you mean a specific subset.
+ *             Kept as a re-export only so existing imports don't
+ *             explode in mid-migration commits.
+ */
+export type LegacyPlatformRole = Role;
 
 export interface SessionUser {
   id: string;
@@ -18,7 +45,7 @@ export interface SessionUser {
   email: string;
   orgId: string;
   orgName: string;
-  roles: PlatformRole[];
+  roles: Role[];
   isPlatform: boolean;
 }
 
@@ -83,11 +110,23 @@ export interface UsageSummary {
 
 // Registration
 export interface RegistrationInput {
-  companyName: string;
+  /**
+   * Required for company registrations. Ignored when `isPersonal` is true —
+   * the server then derives the ZITADEL org name from the user's full name
+   * with a "(Personal)" suffix.
+   */
+  companyName?: string;
   givenName: string;
   familyName: string;
   email: string;
   preferredLanguage?: string;
+  /**
+   * Slice 4: when true, registration creates a personal account (one
+   * person, no company). Domain-uniqueness check is skipped, ZITADEL org
+   * is named "{givenName} {familyName} (Personal)", subsequent tenants
+   * are named with the `p-{requestId[:8]}` convention.
+   */
+  isPersonal?: boolean;
 }
 
 // Billing address
@@ -131,6 +170,13 @@ export interface TenantRequest {
   adminNotes?: string;
   tenantName?: string;
   encryptedSecrets?: Buffer | null;
+  /**
+   * Slice 4: true for personal accounts. Drives CR-naming (`p-{suffix}`
+   * vs `{slug}-{suffix}` in `lib/tenant-naming.ts`), display-name
+   * fallback (contact name vs company name), and exclusion from the
+   * domain-uniqueness check on subsequent registrations.
+   */
+  isPersonal?: boolean;
   createdAt: string;
   updatedAt: string;
 }