Tap a person to see everything they can reach, grouped by app. Check a tab to grant
everything in it — now and in the future; check a single tile to grant just that tile
(a tile-only person gets a one-tile Pulse). AllureOS itself is gated by Super-admin.
Loading auth gate…
A guest signs in but is not an employee — an outside bookkeeper, an auditor.
They never appear in Organization or HR, and they don't see Twine Spaces. Adding them only puts
them on this list. Tick what they can reach and press Activate — that creates their sign-in and
emails them how to get in (start.allureos.ai, a 6-digit code, no password). With a mobile on file the
code comes by text, like staff — the email code depends on their firm's mail letting it through.
Hub Sites · Phase 2 Rollout
Each Hub site embeds auth-gate.js, retires its legacy password gate, and redeploys — that's
the whole change. No per-site Clerk env vars: the gate is client-side and the server check
runs centrally on allure-os. One site per session; the four named sites each have a
self-contained CLERK-AUTH-ROLLOUT.md in their project folder.