Household access is role-based, and roles are enforced by the database rather than the interface.
Roles
- Owner. Creates the household, manages billing, can delete the household, and holds every administrator permission.
- Admin. Invites and removes members, edits shared subscriptions, and initiates shared actions.
- Member. Sees the shared view, shares their own subscriptions in, and acts on the items they own.
- Viewer. Read-only access to the shared view.
What roles cannot do
No role grants access to another member's raw bank feed, payment methods, or personal subscriptions. Shared visibility is opt-in per subscription, always.
Changing roles
Owners and admins change roles from the household members list. There is always exactly one owner; transferring ownership moves billing responsibility with it.
Accountability
Membership changes, role changes, and actions on shared subscriptions are recorded with the actor and timestamp so the household can see who did what.
Platform roles
Separately from households, Flowarden staff hold platform roles — negotiator, admin, and super admin — scoped to the functions each needs. Privileged staff actions are written to an append-only audit log.