Example

Share a project, and nothing else

A member sees everything in the project and nothing outside it — enforced by the query, not by a check somebody has to remember.

15 steps, driven by a person. Every step is a step in an end-to-end test, run against a listening server on every pull request, so the graph moves the way the run moved it.

Why it is shaped this way

Membership is not a permission checked before a read: it is the set of projects every query is built from. A project you are not in is not refused, it is absent — there is no query that can return a task from it. And a member is a full member: read-only invitees are a billing failure waiting to land on somebody's write path, so what a role decides is who else gets in, never what the work looks like. Sharing refuses nothing either: an address with no Flow account is invited by mail rather than turned away, because the address is the credential and there is nothing to sign up for. Nobody is put in a project without saying yes, though: an invitation reaches nothing until the person it names accepts it.