# Members and invites

People join a vault only by invite, with a role an owner picks, and only the owner of a vault manages who is in it.

## Members

A vault's members are on **Settings**, **Members**. Every member sees who else is in the vault, by email and role. Owners also get:

- **Invite someone**: an email address and a role (owner, editor or viewer).
- A role picker for each member, and **Remove** behind a confirm page.
- Pending invites, with **Revoke**.
- Each member's agent connections that reach this vault, with **Revoke**, which cuts that connection off from this vault only.

A vault always keeps an owner: the only owner can't step down, leave or remove themself. Make someone else an owner first.

Managing members is in the [ceiling](agents.md): no agent can do any of it, and no agent ever learns members' email addresses.

## Invites

An invite is a link for one email address, with a role:

- It works once, for 7 days, and only for someone signed in with that address.
- Reliquary doesn't email invites yet: the owner copies the link, shown once, and sends it.
- Inviting an address again replaces its earlier invite.
- An owner can have at most 50 invites waiting in a vault, and one person can create 20 an hour.

The person opens the link, signs in (or is asked to, and comes back), and joins with that role. See [Invite someone](../how-to/invite-someone.md).

## Leaving and removal

Any member can leave on **Settings**, **Leave this vault**, after a confirm page. A removed or departed member, and their agents, lose access at once: tokens that reached only that vault are revoked, and the vault drops out of tokens that reached several. Coming back takes a new invite.

Leaving, removal and role changes are logged, by id, never by email.

## How people are shown

Where the web app names a person (Activity, proposals, threads, Review), it shows their email if they share a vault with you now. Anyone else, like a former member, shows as a short id.