Every invitation bought a seat, including the ones that should not have
A construction project is thirty companies. Charging a seat for each person invited onto one made the honest answer to "who should we put on this" be "as few as we can afford" — which puts holes in the record exactly where the work happens.
A project invitation created a paid identity. That is the ordinary way this is built, and on a construction project it is wrong in a way that damages the thing the platform exists to produce.
The arithmetic is unforgiving. A main contractor running a mid-sized job has a client, a client's representative, a designer, a principal designer, four or five specialist subcontractors and a supply chain behind each of those. Two hundred people is unremarkable. Charging for every one of them means the person deciding who gets an account is choosing between the budget and the completeness of the record — and the record loses, every time, because the budget is this month and the record matters at adjudication in two years.
So the fix was not a discount. It was to separate three things the system had been treating as one: who a person is, what their organisation pays for, and which projects they have been invited onto.
A seat now attaches to authority rather than to access. Of the twenty roles the platform grants, ten hold Controller authority — they approve money, baselines or contracts, administer people, or run the business. The other ten are participants: site, quality, design, supervision, supply. A participant consumes no seat at all, internal or external. The site manager filing a daily diary and the subcontractor closing a snag are the people whose records make the golden thread worth having, and they are now free to add.
The harder half is the Controller who does not work for you. A quantity surveyor invited from the client's side already holds a Controller licence — their own firm pays for it. Charging you again for the same person is charging twice for one seat, and it is the specific thing that makes cross-organisation working expensive enough that people avoid it.
Licence resolution therefore looks outward before it looks at your subscription: the person's own organisation first, then any company in their group, then a pass you chose to buy, then nothing. Where the answer is nothing, the platform does not refuse the invitation and does not quietly bill you. It admits the person as a participant, withholds the Controller roles, and says which licence would open them. Buying a Project Controller Pass is then a decision somebody takes, for one person, on one project, for a period they set.
The rule underneath all of it is one sentence, and it is worth stating plainly because the code enforces it in the seat count rather than in a policy document: a project invitation must never add somebody to the host organisation's paid seats.
AI spend needed the same treatment and did not have it. A guest running an engine was spending somebody's money and the platform had one wallet to reach for. Now an execution resolves to an approved sponsor — the guest's own organisation under a limit it consented to, or the host under a one-time authorisation it gave — and where neither exists the work is refused rather than charged to whoever happened to be nearest. No automatic billing, and no duplicate.
What this cost to build was mostly the offboarding, which is the half nobody demonstrates: a membership that expires, a licence that lapses when the guest's own firm stops paying, roles that come back when it resumes, open AI holds released when access ends, and an external identity deactivated when its last project membership goes. An access model that cannot be ended cleanly is not an access model, it is an accumulation.
See the record being made rather than described.
Launch the demo environment