Every app with shared access eventually gets asked for "can my daughter manage my account for me." My instinct was full RBAC. What MyVitals actually needed — one person managing a household's lab reports — was closer to "let me act as this person entirely," not granular per-resource permissions. Building it safely was the interesting part. The model: an invite is a membership, not a separate thing FamilyMember is one row per (familyId, invitedEmail) , representing a pendin...