People and access

Your organization is your business in Continual. Everyone and everything that acts in it is an actor, and each actor's roles decide what it may do, and where. Continual's agent works under the same rules as everyone else.

Who acts

Actor	What it is	Example
Member	A person in your organization	Ana, an accountant
Service account	An actor that is not a person, of kind Agent or Integration	Continual; a GitHub sync

You sign in once, with Google, as a user. You can belong to several organizations, and in each one you are a member. Roles go to members, never to users.

A member moves through these statuses:

1. Invited
2. Active
3. Suspended

Only active members work in the organization. An invited member can own work before they first sign in. A suspended member loses access but keeps their roles.

Continual's agent has its own service account, which every organization gets with the Agent app. Each app's automations also run as service accounts of their own, so every change names who made it.

Where work lives

Every record lives somewhere, and records form one tree under your organization. A role given at one place reaches the records under it.

Place	What lives there	Private
The organization	Each app's records, such as deals and invoices; companies, people, products; shared settings	No
A project	Its tasks, and the comments and to-dos on them	Yes
A saved view	Its filter, sort, and columns	Yes
Your own work	Your threads with Continual, your mail, your memory and settings	Yes

A private place stops roles from above. An organization admin sees that a project exists, and its name, but not the tasks inside it, until someone shares the project with them. Whoever starts a project or saves a view owns it, and shares it from Share… in its ⋯ menu. Your own work is yours alone.

Roles

A role is a set of permissions, such as reading invoices or issuing them. You give a role to an actor, or to everyone in the organization, at one place, and it reaches everything under that place.

Organization roles

Role	What it allows
Member	Work on what everyone shares: companies, people, comments, to-dos, settings you may read
Admin	Manage people, service accounts, apps, the domain, and who holds which role

Every member holds Member, given once to the whole organization. The person who creates the organization is also its admin. An organization always keeps at least one active admin.

An admin sees an app's records only with one of the app's roles, which an admin may give themselves.

App roles

Each app brings its own roles when you install it.

App	Role	Given to	Allows
Sales	Member	Every member	Work deals, quotes, and orders
Projects	Member	Every member	Start projects and see shared work
Projects	Owner, Editor, Viewer	People on one project	Manage, change, or read that project
Finance	Accountant	Only who an admin chooses	Keep the books, issue invoices
Finance	Finance viewer	Only who an admin chooses	Read the books and change nothing

Roles given to every member never reach service accounts. A service account, Continual's included, holds only the roles an admin gives it. Give and take roles in Settings › Members.

How permissions add up

• Roles only add. Each role grants more, and none takes anything away.
• To point at a record, you must be allowed to link to it. Naming a customer on an invoice needs access to that customer.
• What you write is yours. Only the author changes or takes back a comment or a reaction; admins cannot.
• Every change to access is recorded, like every other change.

Approvals come after access: they decide which allowed changes wait for a yes, and never grant anything a role does not. See approvals.

How the business is organized

Coming. A business has three structures, and Continual keeps them apart, so a reorganization never moves an invoice or rewrites the books:

Structure	Answers	In Continual
Teams	Who works together on what?	Teams hold their work and roles; your organization is the top team
Entities	Which legal company signs, owns, and files?	Each legal entity keeps its own books, invoices, and payments
Managers	Who answers to whom?	A manager on each person, used to route approvals

• Teams nest, and members of a team see the work of the teams under it. A team gives its roles to its members, agents included, and keeps its own processes, projects, and settings.
• Entities are where the documents that post live, so an accountant can be given the UK entity's books and nothing else. Companies, people, and products stay shared across the organization.
• Groups hold roles for people and agents who cut across teams, such as everyone who approves payments.
• Cost centers and departments are details on each ledger entry, never places, so moving a team never restates past numbers.

A new organization has one entity and one team, your organization itself, and you never see either until you add a second.

Acting on someone's behalf

Continual's agent always works on behalf of an actor. When it works for you, it reaches what you reach, and nothing more, and its own authority caps what it does alone: by default, it drafts and changes freely, asks before it finalizes, sends, pays, or deletes, and never changes who has access. See approvals.

The same rule holds for anyone acting for someone else, such as an assistant working in an executive's mail: their access, capped by the assistant's own authority.

Every change records who made it, for whom, and why: "Continual, for Ana, from her request". See activity.

Coming: you give Continual your consent to act for you, and can take it back at any time. Continual also works for service accounts, such as Finance collections, with only that account's roles, directed by the people who operate it. Work a person sets running, such as a watch, runs on their behalf, and pauses if they leave until an admin gives it a new owner.

Remove someone

Suspending a member keeps their roles and work, and they can be reactivated. Removing a member deletes their own work: their threads with Continual, their memory, and their personal connections. Shared records they created, such as deals and invoices, stay with the organization.

Join by email domain

If your company uses Google Workspace, an admin can claim its domain under Settings › Members › Google Workspace domain. Colleagues then see the organization when they sign in, and choose to join it without an invitation.

• A domain belongs to only one organization.
• Continual claims a domain only from Google's verified Workspace domain, never from an email address alone.
• Signing in never adds anyone by itself.