Understand Messaging access and people updates¶
Messaging access depends on your workspace membership, the products available to you and the conversation or work you are trying to open. A person appearing in a directory, an old conversation remaining visible or an administrator assigning access does not by itself establish that every related action is ready.
Availability: This guide explains the inspected backend behavior and the existing Limited Access design. The frontend is still being connected. The design's promise about official updates during limited access needs reconciliation with the implemented access rules. These are access and recovery explanations, not new instructions for an administration or purchase screen.
Understand the different access checks¶
| Check | What it means for you |
|---|---|
| Workspace membership | Your membership must be active for Messaging's effective basic and advanced access. Being listed as a person is a separate matter. |
| WorkOS access | Messaging's basic access calculation requires base WorkOS access. Membership alone does not enable it. |
| Advanced HiveComms | Group conversations, channels and workstream discussions additionally require advanced access assigned to you. Advanced access does not replace the base requirements. |
| Conversation participation | Product access does not automatically make you a participant in another person's conversation. Creating, joining, leaving and removing people have their own rules. |
| Access to the underlying work | A conversation, inbox item or notification can refer to work whose current permissions and state must be checked separately. |
The capability rules associate basic access with the inbox, one-to-one messages, official workstream updates and meeting summaries. They associate advanced access with group messages, channels and workstream discussions. Individual operations do not all apply these checks in the same place. A visible section or successful preview is therefore not a reliable test of everything you can do there.
For example, a meeting summary does not grant admission to the meeting. Access to official workflow updates does not grant permission to approve that workflow. A manager or executive title does not grant access to every employee's messages.
Use Start conversations and manage people for participant rules and Follow work in a workstream for source-work and discussion boundaries. Removing someone from a conversation and removing their workspace access are different actions.
When live updates stop¶
Messaging checks both your account and the workspace's current product access when a live connection opens and when it receives an action. An already open window does not extend subscription coverage. A workspace access-change notification can also close that workspace's connections so they must establish current access again.
A closed connection does not by itself mean you owe a payment or that your last message failed. Access verification may be temporarily unavailable, your account may need a new sign-in, or the workspace may have a commercial or administrative restriction. Reconnect after a temporary verification problem; follow the sign-in instruction for an invalid account session. For workspace restrictions, ask an administrator to check the current coverage and recovery rules and pause reason. Payment cannot remove every administrative pause.
After access returns, reload the saved conversation and check whether your message or action already appears before trying it again. The system's ordinary message send has no guarantee that repeating it will reuse the same message. Reconnecting can restore access to live updates; it does not prove delivery of a missed update or repair a licensing projection.
These are implemented access boundaries and recovery guidance. The connected frontend and its reconnect/error presentation still need verification against the final designs. Conversation participation, workstream permissions and advanced access remain separate checks.
After an administrator changes access¶
Messaging keeps a local record of access changes received from other platform services. Its membership updates now consult the owning workspace record during recovery and preserve the order of changes belonging to one membership. Product access and advanced assignments still arrive separately and retain their own rules below. A recently assigned license can therefore differ from the access Messaging currently evaluates. These backend safeguards do not establish an immediate synchronization guarantee or verify that the connected interface is ready.
The order of updates can matter. If an advanced assignment reaches Messaging before base WorkOS access, the local record can keep advanced access disabled even after the base update arrives. Removing base access also clears the local advanced flag; restoring the base does not automatically restore that flag. Organization-wide plan updates and individual product updates can overwrite the same local base-access value.
These cases need an authorized administrator or support investigation against current membership and commercial records. A browser refresh can help you see a newer result, but it cannot repair an incorrect access record. Do not buy another seat, remove and re-add someone, or repeatedly change a license merely to try to clear the symptom.
If access was removed for a security reason, the administrator must also verify the relevant connected sessions and service behavior. This documentation does not establish how quickly every open connection or previously issued link is revoked.
Interpret limited access carefully¶
The inspected Limited Access design says official updates remain available when basic messaging is unavailable. The current backend uses the same effective basic-access calculation for official updates and one-to-one messaging. There is no verified exception in that calculation that supports the design's broader promise.
Until the design and implementation are reconciled, check whether the particular official update actually opens in your connected workspace. If it does not, use the original work area when you have permission, or contact your administrator. An error opening a conversation does not establish that the underlying request has disappeared or no longer requires your attention.
Support should distinguish access still being reconciled, access not assigned, and no permission for this particular conversation or work item. The current connected interface may not yet explain those differences clearly.
Understand people details¶
Messaging keeps a copy of a person's name, picture, job title, department label and selected account details. These details help you recognize a colleague; they are not the authoritative organization chart or proof that the person currently has access to the proposed conversation.
Profile updates can change the displayed name, picture, job title, department, organization-head status and local active status. The inspected update path does not change the email address or account identity on an existing Messaging person record. An email change elsewhere may therefore leave an older address here. A missing picture can clear the stored picture rather than preserve the previous one.
Do not infer leave status or full employment status from Messaging's active label. The profile update uses whether the person can access WorkOS; it does not independently reproduce all workforce states. Older profile updates can also overwrite newer values because this path does not compare their source times.
If a person is missing, duplicated, incorrectly named or shown with an old address, verify the intended recipient before sending private information. Ask an authorized administrator to reconcile the workforce record, account and Messaging copy. Changing a conversation title will not correct the person's profile.
Recover when access or a profile looks wrong¶
| Situation | Useful next step |
|---|---|
| You recently received access but still cannot open Messaging | Confirm the correct workspace and affected action. Ask the administrator to compare current membership, base access, advanced assignment where needed, and Messaging's received updates. |
| One-to-one messaging works but a group or channel does not | Check advanced access and your membership in that specific conversation. An existing group may retain former participant records, so its current visible headcount is not a reliable license test. |
| Official updates fail in a limited-access view | Check the original work through an authorized route. Report the discrepancy rather than rely on the design's unresolved exception. |
| A colleague appears in search but cannot participate | Ask the administrator to check their current access and the conversation or work audience. Directory presence is not an access grant. |
| A profile has an old email, department or picture | Verify the recipient, then report the changed field and approximate change time through approved support. Do not share unnecessary message contents. |
| A refresh changes nothing, or access returns and disappears | Stop repeating access changes. Support needs to examine the authoritative state and the order of received updates. |
Provide the workspace, affected person, action attempted, approximate time, visible error and any recent membership or license change. Use an approved support channel; do not send passwords, access tokens or private conversations as diagnostic evidence.
For administrators and business owners¶
Separate purchasing and assignment decisions from confirmation that a person can perform the intended task. Validate the actual task in the correct workspace and conversation after an access change. Do not use a directory count, a successful billing update or one person's working session as evidence that every intended user is ready.
Plan support ownership for access and profile discrepancies. Membership, commercial entitlements, workforce details and conversation participation have different owners. These pages describe current behavior; they do not set prices, promise a synchronization time or establish a service commitment.