Herd_allowed_domains
Email domains allowlisted for herd invitations and membership
| Column Name | Data Type | Constraints |
|---|---|---|
| id | bigint | NOT NULL |
| herd_id | bigint | NOT NULL |
| domain | text | NOT NULL |
| created_at | timestamp with time zone | DEFAULT timezone('utc'::text, now()) NOT NULL |
| lifecycle | public.entity_lifecycle (active, retired, deleted) | DEFAULT active NOT NULL |
| lifecycle_changed_at | timestamp with time zone | DEFAULT timezone('utc'::text, now()) NOT NULL |
| lifecycle_changed_by | uuid | |
| lifecycle_reason | text |
Domains are stored lowercase without @ (e.g. example.com). Invitee emails must match the domain exactly (subdomains do not match a parent domain). Only lifecycle = active domains permit invites and acceptance.
Security Policies (RLS)
RLS enabled. Herd scope: Herd from herd_allowed_domains.herd_id.
| Operation | has_herd_ability ability key | Other paths |
|---|---|---|
| SELECT | herd_allowed_domains.read | — |
| INSERT | herd_allowed_domains.write | — |
| UPDATE | herd_allowed_domains.write | — |
| DELETE | herd_allowed_domains.write | — |
Platform superadmin: FOR ALL bypass where defined.