Members and Roles Documentation

How to read this document

Sections move from purpose → concepts → calculation process → worked examples → edge cases. Formula boxes use plain mathematical notation for clarity; they are conceptual summaries, not API contracts.

• Point lists call out operator-visible behaviour.
• Callouts mark warnings, limitations, or important qualifications.
• Worked examples use round numbers so you can reproduce the arithmetic by hand.

Purpose

Membership controls who participates in a household and what each person can do.

• Invite known people
• Assign an appropriate role
• Constrain write and client access
• Review and revoke access

Role concepts

• Administrator — household-wide management.
• Member — operational access within permissions.
• Viewer — read-oriented access.
• A read-only switch (can_write off) can remove write access from any member regardless of role.
• Additional per-person permissions can further constrain actions.

The household owner holds a standing above the admin role: only the owner controls the access policy over networks, devices, and app installs, account deletion, the full-household encrypted backup, and the location-capture kill switch. Demoting or removing admins never transfers these to another member automatically.

Invitations

Verify the recipient and household before sending or accepting an invitation. Expired, mistaken, or unused invites should be withdrawn where supported.

Permissions and clients

Role is a baseline, not always the entire authorization decision. Feature, write, web, and mobile controls can combine.

• Concrete per-person permissions include manage_bank_accounts, manage_external_accounts, manage_assets, manage_recurring, manage_docuvault, manage_developer_api, view_member_spending, and view_split.
• Each permission gates its named surface — for example view_member_spending controls the per-member analytics breakdown and manage_developer_api controls API key management.

Per-household entitlements

Separate from roles and permissions, some features are entitlements toggled per household by platform operators: chat calls, Bank Messages, Insights Engine, ReceiptVis, InteliHouse, Card Intelligence, smart categories, and location. Members — including owners and admins — cannot self-enable an entitlement.

• A missing feature surface usually means the entitlement is off, not a broken install.
• Roles and permissions still apply on top: an entitlement being on does not bypass a member's permission checks.

Presence on the Members screen

The Members screen shows live presence for household calls, so you can see who is reachable before starting one. See the Chat & Calls module for call behaviour.

Least privilege

Role changes and offboarding

• Review ownership before demoting an admin.
• Revoke departed members promptly.
• End relevant sessions.
• Review shared exports and downloads.
• Check independent Split groups separately.

Visibility caveats

Privacy, advice limits, and what we do not publish

AccountHouse is a household tracking and organisation tool. It is not a bank, payment processor, tax advisor, or investment advisor. Forecasts, health scores, balances, and alerts are informational.

• Household data is scoped to your household; other families cannot see your ledger.
• Public documentation explains product behaviour and calculation concepts, not proprietary internals.
• Exact scoring weights, anomaly thresholds, cryptography parameters beyond high-level algorithms, and operational detection rules are reserved.
• Household membership does not necessarily grant unrestricted access to independent Split groups or every sensitive detail.