Enhance the team role management system to support seamless role transitions. When a team member's access level changes, the system should automatically handle all credential operations — creation, upgrade, and revocation — in a single atomic operation, with clear admin feedback at every step.
Why this matters
Today, changing a team member's role often requires separate follow-up steps: provisioning a login when access is granted, or manually cleaning up credentials when access is revoked. This is error-prone and leaves stale accounts behind. Admins should be able to change someone's role and trust the system to handle the full credential lifecycle automatically.
How it works
When an admin edits a member's role in the Control Panel and saves, the change is processed as a single transaction:
- Upgrade to editor/admin: Credentials are created or upgraded as part of the save — no second modal, no separate "send invite" step.
- Downgrade or revoke access: Associated credentials are deactivated in the same operation, so the member immediately loses the ability to log in.
- Batch operations: Multiple role changes made in one Control Panel session are saved together for faster commits.
- Permission model: Role changes respect the workspace admin hierarchy — admins cannot elevate someone above their own level.
- Audit trail: Every role transition is logged with who changed what, when, and the credential actions that were triggered.
Scope
- Control Panel team management UI: inline role editor with atomic save
- Backend: transactional role + credential updates
- Audit log integration for role transitions
- Toast/inline feedback showing which credential actions were taken