The Bizzux Access Model: Identity, Organizations, Apps, and Roles

If you've ever wondered why inviting a teammate to Bizzux Projects doesn't ask them to make a whole new account, or why the same person can see different things depending on which company they're working as — this is the model behind it. Four separate concepts, each doing one job.

1. Identity: who the person is

Every person who signs in to Bizzux — with email/password or Google — gets exactly one identity: one Firebase account, tied to one email address. This identity is global. It isn't owned by any one company or app. You sign in once, and that same identity is what every Bizzux app (Projects, Notes, Files, Chat, Business, POS) recognizes.

2. Organization membership: which company they belong to

An identity on its own doesn't belong to anything — it becomes useful once it's a member of an organization. Creating your own company on Bizzux makes you the Owner of a new organization. Being invited by someone else's company adds you as a member of theirs too.

This is the part people usually get wrong: one identity can belong to more than one organization at the same time. If you run your own small business on Bizzux and a client also invites you onto their team, you don't need a second account — you just have two memberships, and you can switch between them from the account switcher.

Your own organization: you're the Owner. A company that invited you: you're a Member (or whatever role they gave you). Data never mixes between them — projects, notes, files, and CRM records in one organization are never visible from another, even though it's the same person signed in. 3. App entitlement: which Bizzux apps they can use

Belonging to an organization doesn't automatically hand you every app that organization has. Access to each app — Projects, Notes, Files, CRM, and so on — is granted separately, per organization. An owner decides, app by app, who on their team gets in.

This is also why the same person can have Projects access in one organization and none in another: entitlement lives on the (organization, app) pair, not on the person alone.

4. Role: what they can do inside that app

Once someone has access to an app inside an organization, their role decides what they can actually do there. Roles are scoped to the app, not global — an Owner in Bizzux Projects might be a plain Viewer in the CRM, in the very same organization.

This is what lets an owner hand a contractor edit rights on one project without also handing them admin rights on the CRM, the timesheets, or the company's billing.

Same identity, same login — but membership, access, and role are always decided separately, per organization.

Why it's built this way

Two things fall out of keeping these four concepts separate:

No duplicate accounts. If someone already has a Bizzux login — even from trying a different app on their own — inviting them to your team reuses that login instead of asking them to sign up again. Real data isolation. Your organization's tasks, notes, files, and customer records are never reachable from another organization, even one the same person also belongs to. In short: one identity, any number of organizations, access decided per app, and permissions decided per role within that app. That's the whole model.