diff --git a/apps/docs/app/[lang]/[[...slug]]/page.tsx b/apps/docs/app/[lang]/[[...slug]]/page.tsx
index 2d9e00a8849..438968103cf 100644
--- a/apps/docs/app/[lang]/[[...slug]]/page.tsx
+++ b/apps/docs/app/[lang]/[[...slug]]/page.tsx
@@ -121,7 +121,7 @@ export default async function Page(props: { params: Promise<{ slug?: string[]; l
     const urlParts = page.url.split('/').filter(Boolean)
     let currentPath = ''
 
-    urlParts.forEach((part, index) => {
+    urlParts.forEach((part: string, index: number) => {
       if (index === 0 && SUPPORTED_LANGUAGES.has(part)) {
         currentPath = `/${part}`
         return
@@ -131,7 +131,7 @@ export default async function Page(props: { params: Promise<{ slug?: string[]; l
 
       const name = part
         .split('-')
-        .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+        .map((word: string) => word.charAt(0).toUpperCase() + word.slice(1))
         .join(' ')
 
       if (index === urlParts.length - 1) {
diff --git a/apps/docs/app/api/chat/route.ts b/apps/docs/app/api/chat/route.ts
index 2150e044980..915fe9a39c4 100644
--- a/apps/docs/app/api/chat/route.ts
+++ b/apps/docs/app/api/chat/route.ts
@@ -1,7 +1,13 @@
 import { openai } from '@ai-sdk/openai'
-import { convertToModelMessages, stepCountIs, streamText, tool, type UIMessage } from 'ai'
+import {
+  convertToModelMessages,
+  jsonSchema,
+  stepCountIs,
+  streamText,
+  tool,
+  type UIMessage,
+} from 'ai'
 import { sql } from 'drizzle-orm'
-import { z } from 'zod'
 import { db, docsEmbeddings } from '@/lib/db'
 import { generateSearchEmbedding } from '@/lib/embeddings'
 
@@ -332,8 +338,21 @@ export async function POST(req: Request) {
       searchDocs: tool({
         description:
           'Search the Sim documentation for relevant content. Use this before answering any question about Sim.',
-        inputSchema: z.object({
-          query: z.string().describe('A focused natural-language search query.'),
+        /**
+         * The SDK's own schema helper instead of a zod schema: the `ai`
+         * package's zod-v4 typings lag the workspace zod version, so a zod
+         * object here fails the tool() overloads whenever the two drift.
+         */
+        inputSchema: jsonSchema<{ query: string }>({
+          type: 'object',
+          properties: {
+            query: {
+              type: 'string',
+              description: 'A focused natural-language search query.',
+            },
+          },
+          required: ['query'],
+          additionalProperties: false,
         }),
         execute: async ({ query }) => searchDocs(query, locale),
       }),
diff --git a/apps/docs/content/docs/en/platform/costs.mdx b/apps/docs/content/docs/en/platform/costs.mdx
index 26c47fe0898..46f379730c1 100644
--- a/apps/docs/content/docs/en/platform/costs.mdx
+++ b/apps/docs/content/docs/en/platform/costs.mdx
@@ -321,7 +321,7 @@ By default, your usage is capped at the credits included in your plan. To allow
 | **Max** | Up to 10 | — |
 | **Team / Enterprise** | — | Unlimited (Owners and Admins) |
 
-Team and Enterprise plans unlock shared workspaces that belong to your organization. Every workspace created under a Team or Enterprise plan is organization-owned: Owners and Admins can create unlimited shared workspaces, while organization Members cannot create workspaces (personal workspaces created before joining the organization remain accessible). Internal members invited to a shared workspace join the organization and count toward your seat total — Enterprise invites require an available seat at invite time, while Team plans add a seat automatically when the invitee accepts. Existing Sim users who already belong to another organization can be added as external workspace members; they get workspace access without joining your organization or using one of your seats. When a Team or Enterprise subscription is cancelled or downgraded, existing shared workspaces remain accessible to current members but new invites are disabled until the organization is upgraded again.
+Team and Enterprise plans unlock shared workspaces that belong to your organization. Every workspace created under a Team or Enterprise plan is organization-owned: Owners and Admins can create unlimited shared workspaces, while organization Members cannot create workspaces. When someone joins the organization as an internal member, personal workspaces they own move into the organization and their usage is billed to it from then on. Internal members count toward your seat total — Enterprise invites require an available seat at invite time, while Team plans add a seat automatically when the invitee accepts. External workspace members get access to specific workspaces without joining your organization or using one of your seats; they must already be on a paid Sim plan (their own Pro or Max subscription, or another organization that seats them), and invitees who already belong to another organization always join this way. When a Team or Enterprise subscription is cancelled or downgraded, existing shared workspaces remain accessible to current members but new invites are disabled until the organization is upgraded again.
 
 ### Rate Limits
 
diff --git a/apps/docs/content/docs/en/platform/permissions.mdx b/apps/docs/content/docs/en/platform/permissions.mdx
index 97a7412cc64..c6af67ec2b1 100644
--- a/apps/docs/content/docs/en/platform/permissions.mdx
+++ b/apps/docs/content/docs/en/platform/permissions.mdx
@@ -37,7 +37,7 @@ Inherited roles are **automatic and locked**. In member lists they show greyed o
 Sim has two kinds of workspaces:
 
 - **Personal workspaces** live under your individual account. The number you can create depends on your plan.
-- **Shared (organization) workspaces** live under an organization and are available on Team and Enterprise plans. Any organization Owner or Admin can create them. Internal members invited to a shared workspace join the organization and count toward your seat total. Existing Sim users who already belong to another organization can be added as external workspace members instead, giving them access to the workspace without adding them to your organization roster or using one of your seats.
+- **Shared (organization) workspaces** live under an organization and are available on Team and Enterprise plans. Any organization Owner or Admin can create them. When you invite someone to a shared workspace you choose their **Membership**: **Member** or **Admin** makes them an internal member of the organization — they use a seat, and their own workspaces move in with them (see [Joining an organization](#joining-an-organization)) — while **External** gives them access to the selected workspaces only. Invitees who already belong to another organization always become external, because a Sim account belongs to at most one organization.
 
 ### Workspace Limits by Plan
 
@@ -48,7 +48,7 @@ Sim has two kinds of workspaces:
 | **Max** | Up to 10 | — |
 | **Team / Enterprise** | — | Unlimited (Owners and Admins) |
 
-On Team and Enterprise plans, every workspace you create belongs to the organization. Organization Owners and Admins can create unlimited shared workspaces; organization Members cannot create workspaces. Personal workspaces created before joining the organization remain accessible. Enterprise invites require an available seat at invite time; on Team plans, a seat is added automatically when the invitee accepts.
+On Team and Enterprise plans, every workspace you create belongs to the organization. Organization Owners and Admins can create unlimited shared workspaces; organization Members cannot create workspaces. Personal workspaces you owned before joining move into the organization when you accept the invite — see [Joining an organization](#joining-an-organization). Enterprise invites require an available seat at invite time; on Team plans, a seat is added automatically when the invitee accepts.
 
 <Callout type="info">
   When a Team or Enterprise subscription is cancelled or downgraded, existing shared workspaces stay accessible to current members. New invitations are blocked until the organization is upgraded again.
@@ -60,6 +60,12 @@ On Team and Enterprise plans, every workspace you create belongs to the organiza
   <Video src="invitations.mp4" width={700} height={450} />
 </div>
 
+One invite covers everything you give a person at once: enter their emails, select **one or more workspaces**, set the workspace access level, and choose their **Membership**. The same dialog opens from the workspace header and from organization settings.
+
+Invites to the same person add up rather than stacking. If you invite someone to another workspace while their first invite is still pending, the new workspace is added to that invitation — they get one link that grants everything, and accept once.
+
+Because one pending invite can span several workspaces, revoking is scoped to where you do it. Revoking from a workspace's **Teammates** list withdraws that workspace's access only and leaves the rest of the invitation pending; the invitation is cancelled outright when you remove its last workspace. To cancel the whole thing at once, revoke it from organization settings — that needs organization admin, or admin on every workspace the invite covers.
+
 ## Workspace Permission Levels
 
 When inviting someone to a workspace, you can assign one of three permission levels:
@@ -75,10 +81,29 @@ When inviting someone to a workspace, you can assign one of three permission lev
 Workspace permissions are separate from organization membership:
 
 - **Internal organization members** belong to your organization, appear in the organization roster, and count toward your seat total. Invite new teammates this way when they should be part of your company or team in Sim.
-- **External workspace members** have access only to the workspace they are invited to. They keep their own organization membership, do not appear in your organization roster, and do not count toward your organization's seats. Use external access for clients, partners, contractors, or collaborators who already use Sim in another organization.
+- **External workspace members** have access only to the workspaces they are invited to. They are not part of your organization: they do not count toward your seats, their own workspaces stay theirs, and they appear in your roster with an **External** label so admins can always see and revoke their access. Use external access for clients, partners, and contractors.
+
+You pick between the two with the **Membership** option when sending an invite. Three rules apply:
+
+- **External is only available for people already on a paid Sim plan** — their own Pro or Max subscription, or membership in another organization that seats them. External collaborators do not use one of your seats, so they have to be paying for Sim somewhere else. Inviting someone on the free plan as External is rejected with a message telling you to invite them as a Member or Admin instead, which adds a seat.
+- **Invitees who already belong to another organization are always external**, whatever you pick, because an account belongs to at most one organization.
+- **Inviting someone as a Member to the organization itself always includes access to at least one workspace**, so every new member has somewhere to land.
+
+Invitees see what they are agreeing to before they accept. The accept screen names every workspace they are being given, says whether they are joining as a member, an admin, or an external collaborator, says whether that uses one of your seats, and names any of their own workspaces that will move into the organization.
 
 External workspace members still receive a workspace permission level — Read, Write, or Admin — and that permission controls what they can do inside the workspace.
 
+## Joining an organization
+
+Accepting an invite that makes you an **internal member** does more than grant access — it brings your work under the organization:
+
+- **Your workspaces move with you.** Every personal workspace you own, archived ones included, becomes an organization workspace. The accept screen names the workspaces that will move before you accept.
+- **You keep Admin on them.** You remain their administrator; organization Owners and Admins also gain Admin access through the normal [role inheritance](#how-roles-inherit), and usage in those workspaces is billed to the organization from then on.
+- **Your collaborators are not pulled in.** Anyone you had shared those workspaces with keeps their access as an **external member** — they never join the organization or consume a seat as a side effect of your joining.
+- **The workspaces stay if you leave.** If you later leave or are removed from the organization, workspaces you brought in remain with the organization.
+
+Accepting an **external** invite changes none of this: you get access to the invited workspace only, and everything you own stays yours.
+
 ## What Each Permission Level Can Do
 
 Here's a detailed breakdown of what users can do with each permission level:
@@ -147,7 +172,7 @@ Any Admin — whether invited directly or an admin by way of their organization
 2. **Workspace level**: Give them **Admin** permission so they can manage the team and see everything
 
 ### Adding a Stakeholder or Client
-1. **Organization level**: If they should not join your organization, add them as an **External workspace member**
+1. **Membership**: If they should not join your organization, set Membership to **External** — this needs them to already be on a paid Sim plan, since external collaborators do not use one of your seats
 2. **Workspace level**: Give them **Read** permission so they can see progress but not make changes
 
 ---
@@ -221,11 +246,13 @@ import { FAQ } from '@/components/ui/faq'
 
 <FAQ items={[
   { question: "What is the difference between organization roles and workspace permissions?", answer: "Organization roles (Owner, Admin, or Member) control who can manage the organization itself, including inviting people, creating shared workspaces, and handling billing. Workspace permissions (Read, Write, Admin) control what a user can do within a specific workspace, such as viewing, editing, or managing workflows. Internal members need both an organization role and a workspace permission to work within a shared workspace. External workspace members do not have an organization role in your org; they only have workspace-level access." },
+  { question: "What happens to my personal workspaces when I join an organization?", answer: "They move into the organization when you accept the invite — archived workspaces included. The accept screen names the workspaces that will move before you accept. You stay their Admin, organization Owners and Admins gain Admin access through role inheritance, and usage in them is billed to the organization from then on. People you had shared them with keep access as external members. If you later leave the organization, those workspaces stay with it. Accepting an external invite never moves anything — everything you own stays yours." },
+  { question: "What happens when a member is removed from the organization?", answer: "Their workspace access is revoked and workflows they created are reassigned so deployed automations keep running. Credentials backed by their personal identity — OAuth connections and personal environment keys they own — stop working until another member reconnects them; the removal dialog names the affected credentials before you confirm. Workspaces they brought into the organization stay with the organization." },
   { question: "What happens to my shared workspaces if I cancel or downgrade my Team plan?", answer: "Existing shared workspaces remain accessible to current members, but new invitations are disabled until you upgrade back to a Team or Enterprise plan. No workspaces or members are deleted — the organization is simply dormant until billing is re-enabled." },
   { question: "Can I restrict which integrations or model providers a team member can use?", answer: "Yes, on Enterprise-entitled organizations. Any organization owner or admin can create permission groups with fine-grained controls, including restricting allowed integrations and allowed model providers to specific lists. You can also disable access to MCP tools, custom tools, skills, and various platform features like the knowledge base, API keys, or Copilot on a per-group basis. Permission groups are scoped to the organization and can govern either all workspaces or a specific subset — a user can belong to multiple groups but is governed by exactly one group in any given workspace." },
   { question: "What happens when a personal environment variable has the same name as a workspace variable?", answer: "The workspace variable wins. When a workflow runs, the resolver checks workspace variables first and falls back to a personal variable only when no workspace variable shares that name. This keeps shared, team-managed values authoritative in production workflows." },
   { question: "Can an Admin remove the workspace owner?", answer: "On a shared (organization) workspace, yes — any Admin can remove the workspace Owner, and ownership passes to the organization's owner so the workspace always has one. The organization's owner is the single account that can't be removed this way, since they're the final fallback. On your personal workspace you are the Owner and can't remove yourself. The Owner is not a higher permission tier than Admin: every Admin — including those who inherit the role from their organization — can manage members and settings and delete the workspace." },
   { question: "Who can manage a workspace's credentials and secrets?", answer: "Workspace Admins are automatically Credential Admins of the workspace's shared credentials — OAuth connections, service accounts, and workspace environment variables — so they can use, edit, delete, and share them, and run workflows that rely on them. Organization Owners and Admins get this too because they are workspace Admins everywhere. Read and Write members get use-only access to shared credentials unless they are explicitly made a Credential Admin. Personal environment variables are never shared; they stay private to their owner." },
   { question: "What are permission groups and how do they work?", answer: "Permission groups are an Enterprise access control feature that lets organization owners and admins define granular restrictions beyond the standard Read/Write/Admin roles. The organization's default group is org-wide; every other group targets specific workspaces and, by default, governs all members of those workspaces (including external members) — add members to restrict it to specific people. A user is governed by one group per workspace: a group they're an explicit member of takes precedence over an all-members group (one with no members) on that workspace, which takes precedence over the organization's default group. A permission group can hide UI sections (like trace spans, knowledge base, API keys, or deployment options), disable features (MCP tools, custom tools, skills, invitations), and restrict which integrations and model providers its members can access. Only one group per organization can be the default; it ignores members and governs everyone not covered by a workspace group, including external members. Restrictions are enforced based on the organization that owns the workflow's workspace, not on which workspace you're currently viewing." },
-  { question: "How should I set up permissions for a new team member?", answer: "Start with the lowest permission level they need. Invite teammates to the organization as Members, then add them to the relevant workspace with Read permission if they only need visibility, Write if they need to create and run workflows, or Admin if they need to manage the workspace and its users. For clients, partners, or users who already belong to another Sim organization, use external workspace access so they can collaborate without joining your organization or consuming a seat." },
+  { question: "How should I set up permissions for a new team member?", answer: "Start with the lowest permission level they need. Invite them with Read workspace access if they only need visibility, Write if they need to create and run workflows, or Admin if they need to manage the workspace and its users, and leave Membership on Member. For clients, partners, and contractors, choose External so they collaborate without joining your organization or using a seat — this requires them to already be on a paid Sim plan, either their own Pro or Max subscription or another organization that seats them." },
 ]} />
\ No newline at end of file
diff --git a/apps/docs/content/docs/en/platform/workspaces.mdx b/apps/docs/content/docs/en/platform/workspaces.mdx
index bdb3529eae9..4ca445e7b61 100644
--- a/apps/docs/content/docs/en/platform/workspaces.mdx
+++ b/apps/docs/content/docs/en/platform/workspaces.mdx
@@ -66,9 +66,9 @@ Members join with one of three **permission levels**: **Read**, **Write**, or **
 
 Most workspaces are one of two kinds.
 
-A **personal workspace** lives under your own account. Use it for experimentation and individual work. Your plan sets how many you can create.
+A **personal workspace** lives under your own account. Use it for experimentation and individual work. Your plan sets how many you can create. When you join an organization as an internal member, personal workspaces you own move into it — the accept screen names them before you accept.
 
-An **organization workspace** (also called a shared workspace) lives under an organization, available on Team and Enterprise plans. You invite members, each with a permission level. Internal members join the organization and count toward its seat total. External members keep their own organization membership and don't use a seat — that's how partners and clients get access. For agencies and enterprises, this is the workspace you hand to the customer: the app they use, own, and maintain.
+An **organization workspace** (also called a shared workspace) lives under an organization, available on Team and Enterprise plans. You invite people to one or more workspaces at a time, each with a permission level, and choose whether they join as members or as external collaborators. Internal members join the organization, count toward its seat total, and bring their own workspaces with them. External members stay outside the organization — no seat, and everything they own stays theirs — that's how partners and clients get access, and it requires them to already be on a paid Sim plan. For agencies and enterprises, this is the workspace you hand to the customer: the app they use, own, and maintain.
 
 <Callout type="info">
 Plan limits, seat counts, and the internal-versus-external distinction live in [Roles and permissions](/platform/permissions). This page covers what a workspace is, not how billing works.
diff --git a/apps/sim/app/api/invitations/[id]/accept/route.ts b/apps/sim/app/api/invitations/[id]/accept/route.ts
index 6fb0af7972f..112ed9068e1 100644
--- a/apps/sim/app/api/invitations/[id]/accept/route.ts
+++ b/apps/sim/app/api/invitations/[id]/accept/route.ts
@@ -27,12 +27,16 @@ export const POST = withRouteHandler(
       actorName: session.user.name ?? undefined,
       invitationId: id,
       token: parsed.data.body.token ?? null,
+      disclosedWorkspaceIds: parsed.data.body.disclosedWorkspaceIds,
+      disclosedOutcome: parsed.data.body.disclosedOutcome,
       request,
     })
 
     if (!result.success) {
       const statusMap: Record<string, number> = {
         'not-found': 404,
+        'workspace-not-found': 404,
+        'disclosure-outdated': 409,
         'invalid-token': 400,
         'already-processed': 400,
         expired: 400,
@@ -40,11 +44,18 @@ export const POST = withRouteHandler(
         'already-in-organization': 409,
         'no-seats-available': 400,
         'upgrade-required': 402,
+        'external-requires-paid-plan': 402,
         'server-error': 500,
       }
       const status = statusMap[result.kind] ?? 500
       logger.warn('Invitation accept rejected', { invitationId: id, reason: result.kind })
-      return NextResponse.json({ error: result.kind }, { status })
+      /**
+       * `error` stays the machine-readable kind (the client maps it to UX
+       * states); `message` carries the human copy when the failure provides
+       * one — e.g. the retryable concurrent-workspace-change conflict.
+       */
+      const message = result.kind === 'server-error' ? result.message : undefined
+      return NextResponse.json({ error: result.kind, ...(message ? { message } : {}) }, { status })
     }
 
     const inv = result.invitation
diff --git a/apps/sim/app/api/invitations/[id]/route.ts b/apps/sim/app/api/invitations/[id]/route.ts
index f17d2e10a59..ffe9f950454 100644
--- a/apps/sim/app/api/invitations/[id]/route.ts
+++ b/apps/sim/app/api/invitations/[id]/route.ts
@@ -2,10 +2,12 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { invitation, invitationWorkspaceGrant } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
 import { normalizeEmail } from '@sim/utils/string'
 import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
+  cancelInvitationQuerySchema,
   getInvitationContract,
   invitationParamsSchema,
   updateInvitationContract,
@@ -14,7 +16,13 @@ import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { cancelInvitation, getInvitationById } from '@/lib/invitations/core'
+import {
+  cancelInvitation,
+  getInvitationById,
+  getInvitationJoinPreview,
+  isInvitationExpired,
+  revokeInvitationWorkspaceGrant,
+} from '@/lib/invitations/core'
 import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('InvitationsAPI')
@@ -42,22 +50,46 @@ export const GET = withRouteHandler(
       const isInvitee = normalizeEmail(session.user.email || '') === normalizeEmail(inv.email)
       const tokenMatches = !!token && token === inv.token
 
-      let hasAdminView = false
-      if (inv.organizationId) {
-        hasAdminView = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
-      }
-      if (!hasAdminView && inv.grants.length > 0) {
-        const adminChecks = await Promise.all(
-          inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
-        )
-        hasAdminView = adminChecks.some(Boolean)
+      if (!isInvitee && !tokenMatches) {
+        let hasAdminView = false
+        if (inv.organizationId) {
+          hasAdminView = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
+        }
+        if (!hasAdminView && inv.grants.length > 0) {
+          const adminChecks = await Promise.all(
+            inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
+          )
+          hasAdminView = adminChecks.some(Boolean)
+        }
+        if (!hasAdminView) {
+          return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+        }
       }
 
-      if (!isInvitee && !tokenMatches && !hasAdminView) {
-        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+      /**
+       * Disclosure-only: a preview failure must never block viewing or
+       * accepting the invitation itself — but it also must not read as
+       * "nothing moves", so failures are flagged for the client to show a
+       * generic migration notice. Expired-but-still-pending rows get no
+       * preview — acceptance deterministically rejects them.
+       */
+      let joinPreview = null
+      let joinPreviewUnavailable = false
+      if (isInvitee && inv.status === 'pending' && !isInvitationExpired(inv)) {
+        try {
+          joinPreview = await getInvitationJoinPreview(session.user.id, inv)
+        } catch (previewError) {
+          joinPreviewUnavailable = true
+          logger.warn('Failed to compute invitation join preview', {
+            invitationId: id,
+            error: previewError,
+          })
+        }
       }
 
       return NextResponse.json({
+        joinPreview,
+        joinPreviewUnavailable,
         invitation: {
           id: inv.id,
           kind: inv.kind,
@@ -128,6 +160,20 @@ export const PATCH = withRouteHandler(
             { status: 403 }
           )
         }
+        /**
+         * A member-role invite without workspace grants would leave the
+         * invitee workspace-less after accepting (admins derive access to
+         * every organization workspace; members do not).
+         */
+        if (!isOrgAdminRole(role) && inv.grants.length === 0) {
+          return NextResponse.json(
+            {
+              error:
+                'Member invitations must include at least one workspace. Keep the admin role or send a new invitation with workspace access.',
+            },
+            { status: 400 }
+          )
+        }
       }
 
       const grantsToApply = grants ?? []
@@ -207,6 +253,16 @@ export const DELETE = withRouteHandler(
       )
     }
     const { id } = parsedParams.data
+    const parsedQuery = cancelInvitationQuerySchema.safeParse(
+      Object.fromEntries(request.nextUrl.searchParams.entries())
+    )
+    if (!parsedQuery.success) {
+      return NextResponse.json(
+        { error: getValidationErrorMessage(parsedQuery.error, 'Invalid query parameters') },
+        { status: 400 }
+      )
+    }
+    const scopedWorkspaceId = parsedQuery.data.workspaceId
     const session = await getSession()
 
     if (!session?.user?.id) {
@@ -219,28 +275,91 @@ export const DELETE = withRouteHandler(
         return NextResponse.json({ error: 'Invitation not found' }, { status: 404 })
       }
 
-      let canCancel = false
-      if (inv.organizationId) {
-        canCancel = await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
+      if (inv.status !== 'pending') {
+        return NextResponse.json({ error: 'Can only cancel pending invitations' }, { status: 400 })
+      }
+
+      const isOrganizationAdmin = inv.organizationId
+        ? await isOrganizationOwnerOrAdmin(session.user.id, inv.organizationId)
+        : false
+
+      /**
+       * Scoped revocation: an admin of this one workspace may withdraw its own
+       * grant. Authority over the invitation's other workspaces is not implied,
+       * so only that grant is removed.
+       */
+      if (scopedWorkspaceId) {
+        if (!inv.grants.some((grant) => grant.workspaceId === scopedWorkspaceId)) {
+          return NextResponse.json(
+            { error: 'Invitation does not grant access to that workspace' },
+            { status: 400 }
+          )
+        }
+        if (
+          !isOrganizationAdmin &&
+          !(await hasWorkspaceAdminAccess(session.user.id, scopedWorkspaceId))
+        ) {
+          return NextResponse.json(
+            { error: 'You need admin permissions on that workspace to revoke its invitation' },
+            { status: 403 }
+          )
+        }
+
+        const { revoked, invitationCancelled } = await revokeInvitationWorkspaceGrant({
+          invitationId: id,
+          workspaceId: scopedWorkspaceId,
+        })
+        if (!revoked) {
+          return NextResponse.json({ error: 'Invitation not cancellable' }, { status: 400 })
+        }
+
+        recordAudit({
+          workspaceId: scopedWorkspaceId,
+          actorId: session.user.id,
+          actorName: session.user.name ?? undefined,
+          actorEmail: session.user.email ?? undefined,
+          action: AuditAction.INVITATION_REVOKED,
+          resourceType: AuditResourceType.WORKSPACE,
+          resourceId: scopedWorkspaceId,
+          description: `Revoked ${inv.email}'s pending invitation to this workspace`,
+          metadata: {
+            invitationId: id,
+            targetEmail: inv.email,
+            workspaceId: scopedWorkspaceId,
+            invitationCancelled,
+          },
+          request,
+        })
+
+        return NextResponse.json({ success: true, invitationCancelled })
       }
+
+      /**
+       * Whole-invitation revocation needs authority over everything it grants:
+       * organization admins have it implicitly, otherwise the actor must
+       * administer every granted workspace. Admin of just one is not enough —
+       * that would let them destroy grants to workspaces they cannot see.
+       */
+      let canCancel = isOrganizationAdmin
       if (!canCancel && inv.grants.length > 0) {
         const adminChecks = await Promise.all(
           inv.grants.map((grant) => hasWorkspaceAdminAccess(session.user.id, grant.workspaceId))
         )
-        canCancel = adminChecks.some(Boolean)
+        canCancel = adminChecks.every(Boolean)
       }
 
       if (!canCancel) {
         return NextResponse.json(
-          { error: 'Only an organization or workspace admin can cancel this invitation' },
+          {
+            error:
+              inv.grants.length > 1
+                ? 'This invitation spans several workspaces. Revoke it from a workspace you administer, or ask an organization admin.'
+                : 'Only an organization or workspace admin can cancel this invitation',
+          },
           { status: 403 }
         )
       }
 
-      if (inv.status !== 'pending') {
-        return NextResponse.json({ error: 'Can only cancel pending invitations' }, { status: 400 })
-      }
-
       const cancelled = await cancelInvitation(id)
       if (!cancelled) {
         return NextResponse.json({ error: 'Invitation not cancellable' }, { status: 400 })
@@ -268,7 +387,7 @@ export const DELETE = withRouteHandler(
         request,
       })
 
-      return NextResponse.json({ success: true })
+      return NextResponse.json({ success: true, invitationCancelled: true })
     } catch (error) {
       logger.error('Failed to cancel invitation', { invitationId: id, error })
       return NextResponse.json({ error: 'Failed to cancel invitation' }, { status: 500 })
diff --git a/apps/sim/app/api/invitations/route.ts b/apps/sim/app/api/invitations/route.ts
index 802989e7e4f..106a7177799 100644
--- a/apps/sim/app/api/invitations/route.ts
+++ b/apps/sim/app/api/invitations/route.ts
@@ -1,9 +1,9 @@
 import { createLogger } from '@sim/logger'
 import { NextResponse } from 'next/server'
-import type { InvitationDetails } from '@/lib/api/contracts/invitations'
+import type { MyInvitation } from '@/lib/api/contracts/invitations'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { listPendingInvitationsForEmail } from '@/lib/invitations/core'
+import { getInvitationJoinPreview, listPendingInvitationsForEmail } from '@/lib/invitations/core'
 
 const logger = createLogger('MyInvitationsAPI')
 
@@ -22,9 +22,35 @@ export const GET = withRouteHandler(async () => {
   try {
     const invitations = await listPendingInvitationsForEmail(session.user.email)
 
+    /**
+     * Each row carries what accepting it will actually do, so the in-app list
+     * can disclose the workspace migration and echo `disclosedWorkspaceIds` on
+     * accept — the same consent contract the emailed `/invite` page honours.
+     * Disclosure-only, so a preview failure degrades to `null` (the client
+     * shows a generic notice) rather than hiding the invitation.
+     *
+     * Sequential on purpose: each preview issues several queries, and this
+     * endpoint is hit whenever the workspace switcher opens. Fanning them out
+     * with `Promise.all` would hold one pooled connection per pending
+     * invitation for the length of the slowest one. The list is a handful of
+     * rows, so the added latency is not worth the pool pressure.
+     */
+    const previews: Array<Awaited<ReturnType<typeof getInvitationJoinPreview>> | null> = []
+    for (const inv of invitations) {
+      try {
+        previews.push(await getInvitationJoinPreview(session.user.id, inv))
+      } catch (previewError) {
+        logger.warn('Failed to compute join preview for pending invitation', {
+          invitationId: inv.id,
+          error: previewError,
+        })
+        previews.push(null)
+      }
+    }
+
     return NextResponse.json({
       invitations: invitations.map(
-        (inv) =>
+        (inv, index) =>
           ({
             id: inv.id,
             kind: inv.kind,
@@ -43,7 +69,8 @@ export const GET = withRouteHandler(async () => {
               workspaceName: grant.workspaceName,
               permission: grant.permission,
             })),
-          }) satisfies InvitationDetails
+            joinPreview: previews[index],
+          }) satisfies MyInvitation
       ),
     })
   } catch (error) {
diff --git a/apps/sim/app/api/organizations/[id]/invitations/route.test.ts b/apps/sim/app/api/organizations/[id]/invitations/route.test.ts
deleted file mode 100644
index e4592e1318f..00000000000
--- a/apps/sim/app/api/organizations/[id]/invitations/route.test.ts
+++ /dev/null
@@ -1,398 +0,0 @@
-/**
- * @vitest-environment node
- */
-import { member, organization, permissions, user, workspace } from '@sim/db/schema'
-import {
-  auditMock,
-  authMockFns,
-  createMockRequest,
-  createSession,
-  queueTableRows,
-  resetDbChainMock,
-} from '@sim/testing'
-import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
-
-const {
-  mockValidateInvitationsAllowed,
-  mockValidateSeatAvailability,
-  mockCreatePendingInvitation,
-  mockSendInvitationEmail,
-  mockCancelPendingInvitation,
-  mockGrantWorkspaceAccessDirectly,
-} = vi.hoisted(() => ({
-  mockValidateInvitationsAllowed: vi.fn(),
-  mockValidateSeatAvailability: vi.fn(),
-  mockCreatePendingInvitation: vi.fn(),
-  mockSendInvitationEmail: vi.fn(),
-  mockCancelPendingInvitation: vi.fn(),
-  mockGrantWorkspaceAccessDirectly: vi.fn(),
-}))
-
-vi.mock('@sim/audit', () => auditMock)
-
-vi.mock('@/lib/billing/validation/seat-management', () => ({
-  validateBulkInvitations: vi.fn(),
-  validateSeatAvailability: mockValidateSeatAvailability,
-}))
-
-vi.mock('@/lib/invitations/send', () => ({
-  createPendingInvitation: mockCreatePendingInvitation,
-  sendInvitationEmail: mockSendInvitationEmail,
-  cancelPendingInvitation: mockCancelPendingInvitation,
-}))
-
-vi.mock('@/lib/invitations/direct-grant', () => ({
-  grantWorkspaceAccessDirectly: mockGrantWorkspaceAccessDirectly,
-}))
-
-vi.mock('@/lib/messaging/email/validation', () => ({
-  quickValidateEmail: vi.fn((email: string) => ({ isValid: email.includes('@') })),
-}))
-
-vi.mock('@/lib/workspaces/permissions/utils', () => ({
-  hasWorkspaceAdminAccess: vi.fn().mockResolvedValue(true),
-}))
-
-vi.mock('@/lib/workspaces/policy', () => ({
-  isOrganizationWorkspace: vi.fn().mockReturnValue(true),
-}))
-
-vi.mock('@/ee/access-control/utils/permission-check', () => ({
-  InvitationsNotAllowedError: class InvitationsNotAllowedError extends Error {},
-  validateInvitationsAllowed: mockValidateInvitationsAllowed,
-}))
-
-import { POST } from '@/app/api/organizations/[id]/invitations/route'
-
-const mockGetSession = authMockFns.mockGetSession
-
-/** Queues the caller's admin-role check followed by the org-name lookup. */
-function queueOwnerAndOrg() {
-  queueTableRows(member, [{ role: 'owner' }])
-  queueTableRows(organization, [{ name: 'Org One' }])
-}
-
-/** Queues the inviter-details lookup that precedes invitation/email sends. */
-function queueInviterRow() {
-  queueTableRows(user, [{ name: 'Owner', email: 'owner@example.com' }])
-}
-
-afterAll(resetDbChainMock)
-
-describe('POST /api/organizations/[id]/invitations', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    resetDbChainMock()
-    mockValidateInvitationsAllowed.mockResolvedValue(undefined)
-    mockValidateSeatAvailability.mockResolvedValue({
-      canInvite: true,
-      currentSeats: 1,
-      maxSeats: 5,
-      availableSeats: 4,
-    })
-    mockCreatePendingInvitation.mockResolvedValue({
-      invitationId: 'inv-1',
-      token: 'tok-1',
-      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
-    })
-    mockSendInvitationEmail.mockResolvedValue({ success: true })
-    mockGrantWorkspaceAccessDirectly.mockResolvedValue({ outcome: 'added', permission: 'write' })
-  })
-
-  it('creates a unified invitation and sends a single email', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    queueOwnerAndOrg()
-    // Explicit empty existing-members set: the query joins `user`, so it must
-    // not fall through to the inviter row queued on the user table.
-    queueTableRows(member, [])
-    queueInviterRow()
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        { emails: ['invitee@example.com'] },
-        {},
-        'http://localhost/api/organizations/org-1/invitations'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(200)
-    expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
-      expect.objectContaining({
-        kind: 'organization',
-        email: 'invitee@example.com',
-        organizationId: 'org-1',
-        role: 'member',
-        grants: [],
-      })
-    )
-    expect(mockSendInvitationEmail).toHaveBeenCalledWith(
-      expect.objectContaining({ kind: 'organization', email: 'invitee@example.com' })
-    )
-    expect(mockCancelPendingInvitation).not.toHaveBeenCalled()
-  })
-
-  it('adds an existing member directly to selected workspaces they lack (no invitation/email)', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    queueOwnerAndOrg()
-    queueTableRows(workspace, [
-      { id: 'ws-1', name: 'Workspace 1', organizationId: 'org-1', workspaceMode: 'organization' },
-    ])
-    queueTableRows(workspace, [
-      { id: 'ws-2', name: 'Workspace 2', organizationId: 'org-1', workspaceMode: 'organization' },
-    ])
-    queueTableRows(member, [{ userId: 'user-2', userEmail: 'member@example.com' }])
-    queueTableRows(permissions, [{ userId: 'user-2', workspaceId: 'ws-1' }])
-    queueInviterRow()
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        {
-          emails: ['member@example.com'],
-          workspaceInvitations: [
-            { workspaceId: 'ws-1', permission: 'write' },
-            { workspaceId: 'ws-2', permission: 'write' },
-          ],
-        },
-        {},
-        'http://localhost/api/organizations/org-1/invitations?batch=true'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(200)
-    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
-    expect(mockSendInvitationEmail).not.toHaveBeenCalled()
-    expect(mockGrantWorkspaceAccessDirectly).toHaveBeenCalledTimes(1)
-    expect(mockGrantWorkspaceAccessDirectly).toHaveBeenCalledWith(
-      expect.objectContaining({
-        userId: 'user-2',
-        email: 'member@example.com',
-        workspaceId: 'ws-2',
-        permission: 'write',
-        organizationId: 'org-1',
-      })
-    )
-
-    const body = await response.json()
-    expect(body.data.invitationsSent).toBe(0)
-    expect(body.data.directlyAdded).toEqual(['member@example.com'])
-    expect(body.data.directlyAddedCount).toBe(1)
-    expect(body.data.existingMembers).toEqual([])
-  })
-
-  it('reports a partially-failed member only as added, never in both buckets', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    // First grant succeeds, second throws (e.g. transient DB error).
-    mockGrantWorkspaceAccessDirectly
-      .mockResolvedValueOnce({ outcome: 'added', permission: 'write' })
-      .mockRejectedValueOnce(new Error('db blip'))
-    queueOwnerAndOrg()
-    queueTableRows(workspace, [
-      { id: 'ws-1', name: 'Workspace 1', organizationId: 'org-1', workspaceMode: 'organization' },
-    ])
-    queueTableRows(workspace, [
-      { id: 'ws-2', name: 'Workspace 2', organizationId: 'org-1', workspaceMode: 'organization' },
-    ])
-    queueTableRows(member, [{ userId: 'user-2', userEmail: 'member@example.com' }])
-    queueInviterRow()
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        {
-          emails: ['member@example.com'],
-          workspaceInvitations: [
-            { workspaceId: 'ws-1', permission: 'write' },
-            { workspaceId: 'ws-2', permission: 'write' },
-          ],
-        },
-        {},
-        'http://localhost/api/organizations/org-1/invitations?batch=true'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(200)
-    expect(mockGrantWorkspaceAccessDirectly).toHaveBeenCalledTimes(2)
-    const body = await response.json()
-    expect(body.data.directlyAdded).toEqual(['member@example.com'])
-    expect(body.data.failedInvitations).toEqual([])
-  })
-
-  it('returns 207 with both successes and failures when one member is added and another fails', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    mockGrantWorkspaceAccessDirectly
-      .mockResolvedValueOnce({ outcome: 'added', permission: 'write' })
-      .mockRejectedValueOnce(new Error('db blip'))
-    queueOwnerAndOrg()
-    queueTableRows(workspace, [
-      { id: 'ws-1', name: 'Workspace 1', organizationId: 'org-1', workspaceMode: 'organization' },
-    ])
-    queueTableRows(member, [
-      { userId: 'user-a', userEmail: 'a@example.com' },
-      { userId: 'user-b', userEmail: 'b@example.com' },
-    ])
-    queueInviterRow()
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        {
-          emails: ['a@example.com', 'b@example.com'],
-          workspaceInvitations: [{ workspaceId: 'ws-1', permission: 'write' }],
-        },
-        {},
-        'http://localhost/api/organizations/org-1/invitations?batch=true'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(207)
-    const body = await response.json()
-    expect(body.success).toBe(false)
-    expect(body.data.directlyAdded).toEqual(['a@example.com'])
-    expect(body.data.directlyAddedCount).toBe(1)
-    expect(body.data.failedInvitations).toEqual([{ email: 'b@example.com', error: 'db blip' }])
-  })
-
-  it('returns 400 when an existing member already has access to every selected workspace', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    queueOwnerAndOrg()
-    queueTableRows(workspace, [
-      { id: 'ws-1', organizationId: 'org-1', workspaceMode: 'organization' },
-    ])
-    queueTableRows(member, [{ userId: 'user-2', userEmail: 'member@example.com' }])
-    queueTableRows(permissions, [{ userId: 'user-2', workspaceId: 'ws-1' }])
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        {
-          emails: ['member@example.com'],
-          workspaceInvitations: [{ workspaceId: 'ws-1', permission: 'write' }],
-        },
-        {},
-        'http://localhost/api/organizations/org-1/invitations?batch=true'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(400)
-    const body = await response.json()
-    expect(body.error).toContain('already has access')
-    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
-  })
-
-  it('invites new emails to the organization and adds existing members to workspaces in one batch', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    queueOwnerAndOrg()
-    queueTableRows(workspace, [
-      { id: 'ws-1', name: 'Workspace 1', organizationId: 'org-1', workspaceMode: 'organization' },
-    ])
-    queueTableRows(member, [{ userId: 'user-2', userEmail: 'member@example.com' }])
-    queueInviterRow()
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        {
-          emails: ['new@example.com', 'member@example.com'],
-          workspaceInvitations: [{ workspaceId: 'ws-1', permission: 'read' }],
-        },
-        {},
-        'http://localhost/api/organizations/org-1/invitations?batch=true'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(200)
-    expect(mockCreatePendingInvitation).toHaveBeenCalledTimes(1)
-    expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
-      expect.objectContaining({
-        kind: 'organization',
-        email: 'new@example.com',
-        grants: [{ workspaceId: 'ws-1', permission: 'read' }],
-      })
-    )
-    expect(mockGrantWorkspaceAccessDirectly).toHaveBeenCalledTimes(1)
-    expect(mockGrantWorkspaceAccessDirectly).toHaveBeenCalledWith(
-      expect.objectContaining({
-        userId: 'user-2',
-        email: 'member@example.com',
-        workspaceId: 'ws-1',
-        permission: 'read',
-      })
-    )
-
-    const body = await response.json()
-    expect(body.data.invitationsSent).toBe(1)
-    expect(body.data.invitedEmails).toEqual(['new@example.com'])
-    expect(body.data.directlyAdded).toEqual(['member@example.com'])
-    expect(body.data.directlyAddedCount).toBe(1)
-  })
-
-  it('still rejects existing members on the non-batch organization invite path', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    queueOwnerAndOrg()
-    queueTableRows(member, [{ userId: 'user-2', userEmail: 'member@example.com' }])
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        { emails: ['member@example.com'] },
-        {},
-        'http://localhost/api/organizations/org-1/invitations'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(400)
-    const body = await response.json()
-    expect(body.error).toBe(
-      'Failed to send invitation. User is already a part of the organization.'
-    )
-    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
-  })
-
-  it('rolls back the pending invitation when email delivery fails', async () => {
-    mockGetSession.mockResolvedValue(
-      createSession({ userId: 'user-1', email: 'owner@example.com', name: 'Owner' })
-    )
-    queueOwnerAndOrg()
-    // Explicit empty existing-members set: the query joins `user`, so it must
-    // not fall through to the inviter row queued on the user table.
-    queueTableRows(member, [])
-    queueInviterRow()
-    mockSendInvitationEmail.mockResolvedValue({ success: false, error: 'mailer unavailable' })
-
-    const response = await POST(
-      createMockRequest(
-        'POST',
-        { emails: ['invitee@example.com'] },
-        {},
-        'http://localhost/api/organizations/org-1/invitations'
-      ),
-      { params: Promise.resolve({ id: 'org-1' }) }
-    )
-
-    expect(response.status).toBe(502)
-    expect(mockCancelPendingInvitation).toHaveBeenCalledWith('inv-1')
-  })
-})
diff --git a/apps/sim/app/api/organizations/[id]/invitations/route.ts b/apps/sim/app/api/organizations/[id]/invitations/route.ts
index 650aa0f7e90..300d00dddb3 100644
--- a/apps/sim/app/api/organizations/[id]/invitations/route.ts
+++ b/apps/sim/app/api/organizations/[id]/invitations/route.ts
@@ -1,54 +1,16 @@
-import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import {
-  invitation,
-  invitationWorkspaceGrant,
-  member,
-  organization,
-  permissions,
-  user,
-  workspace,
-} from '@sim/db/schema'
+import { invitation, member, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { isOrgAdminRole } from '@sim/platform-authz/workspace'
-import { getErrorMessage } from '@sim/utils/errors'
-import { normalizeEmail } from '@sim/utils/string'
-import { and, eq, inArray } from 'drizzle-orm'
+import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
-import {
-  inviteOrganizationMembersContract,
-  organizationParamsSchema,
-} from '@/lib/api/contracts/organization'
-import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { organizationParamsSchema } from '@/lib/api/contracts/organization'
+import { getValidationErrorMessage } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { getOrganizationSubscription } from '@/lib/billing/core/billing'
-import { isEnterprise } from '@/lib/billing/plan-helpers'
-import {
-  validateBulkInvitations,
-  validateSeatAvailability,
-} from '@/lib/billing/validation/seat-management'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { grantWorkspaceAccessDirectly } from '@/lib/invitations/direct-grant'
-import {
-  cancelPendingInvitation,
-  createPendingInvitation,
-  sendInvitationEmail,
-} from '@/lib/invitations/send'
-import { quickValidateEmail } from '@/lib/messaging/email/validation'
-import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
-import { isOrganizationWorkspace } from '@/lib/workspaces/policy'
-import {
-  InvitationsNotAllowedError,
-  validateInvitationsAllowed,
-} from '@/ee/access-control/utils/permission-check'
 
 const logger = createLogger('OrganizationInvitations')
 
-interface WorkspaceGrantPayload {
-  workspaceId: string
-  permission: 'admin' | 'write' | 'read'
-}
-
 export const GET = withRouteHandler(
   async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
     try {
@@ -112,521 +74,3 @@ export const GET = withRouteHandler(
     }
   }
 )
-
-export const POST = withRouteHandler(
-  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
-    try {
-      const session = await getSession()
-      if (!session?.user?.id) {
-        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-      }
-
-      const parsed = await parseRequest(inviteOrganizationMembersContract, request, context)
-      if (!parsed.success) return parsed.response
-
-      const { id: organizationId } = parsed.data.params
-
-      await validateInvitationsAllowed(session.user.id, { organizationId })
-
-      const validateOnly = parsed.data.query.validate === true
-      const isBatch = parsed.data.query.batch === true
-
-      const { email, emails, role = 'member', workspaceInvitations } = parsed.data.body
-      const invitationEmails = email ? [email] : emails
-
-      if (!invitationEmails || !Array.isArray(invitationEmails) || invitationEmails.length === 0) {
-        return NextResponse.json({ error: 'Email or emails array is required' }, { status: 400 })
-      }
-
-      const [memberEntry] = await db
-        .select()
-        .from(member)
-        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
-        .limit(1)
-
-      if (!memberEntry) {
-        return NextResponse.json(
-          { error: 'Forbidden - Not a member of this organization' },
-          { status: 403 }
-        )
-      }
-
-      if (!isOrgAdminRole(memberEntry.role)) {
-        return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
-      }
-
-      if (validateOnly) {
-        const validationResult = await validateBulkInvitations(organizationId, invitationEmails)
-        return NextResponse.json({
-          success: true,
-          data: validationResult,
-          validatedBy: session.user.id,
-          validatedAt: new Date().toISOString(),
-        })
-      }
-
-      const [organizationEntry] = await db
-        .select({ name: organization.name })
-        .from(organization)
-        .where(eq(organization.id, organizationId))
-        .limit(1)
-
-      if (!organizationEntry) {
-        return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
-      }
-
-      const processedEmails = Array.from(
-        new Set(
-          invitationEmails
-            .map((raw) => {
-              const normalized = normalizeEmail(raw)
-              return quickValidateEmail(normalized).isValid ? normalized : null
-            })
-            .filter((email): email is string => !!email)
-        )
-      )
-
-      if (processedEmails.length === 0) {
-        return NextResponse.json({ error: 'No valid emails provided' }, { status: 400 })
-      }
-
-      const validGrants: WorkspaceGrantPayload[] = []
-      const workspaceNameById = new Map<string, string>()
-      if (isBatch) {
-        if (!Array.isArray(workspaceInvitations) || workspaceInvitations.length === 0) {
-          return NextResponse.json(
-            { error: 'Select at least one organization workspace for this invitation.' },
-            { status: 400 }
-          )
-        }
-
-        for (const wsInvitation of workspaceInvitations) {
-          if (validGrants.some((grant) => grant.workspaceId === wsInvitation.workspaceId)) {
-            continue
-          }
-
-          const canInvite = await hasWorkspaceAdminAccess(session.user.id, wsInvitation.workspaceId)
-          if (!canInvite) {
-            return NextResponse.json(
-              {
-                error: `You don't have permission to invite users to workspace ${wsInvitation.workspaceId}`,
-              },
-              { status: 403 }
-            )
-          }
-
-          const [workspaceEntry] = await db
-            .select({
-              id: workspace.id,
-              name: workspace.name,
-              organizationId: workspace.organizationId,
-              workspaceMode: workspace.workspaceMode,
-            })
-            .from(workspace)
-            .where(eq(workspace.id, wsInvitation.workspaceId))
-            .limit(1)
-
-          if (!workspaceEntry || !isOrganizationWorkspace(workspaceEntry)) {
-            return NextResponse.json(
-              {
-                error: `Workspace ${wsInvitation.workspaceId} is not an organization-owned workspace.`,
-              },
-              { status: 400 }
-            )
-          }
-
-          if (workspaceEntry.organizationId !== organizationId) {
-            return NextResponse.json(
-              {
-                error: `Workspace ${wsInvitation.workspaceId} does not belong to this organization.`,
-              },
-              { status: 400 }
-            )
-          }
-
-          await validateInvitationsAllowed(session.user.id, wsInvitation.workspaceId)
-
-          workspaceNameById.set(workspaceEntry.id, workspaceEntry.name)
-          validGrants.push({
-            workspaceId: wsInvitation.workspaceId,
-            permission: wsInvitation.permission,
-          })
-        }
-      }
-
-      const existingMembers = await db
-        .select({ userId: member.userId, userEmail: user.email })
-        .from(member)
-        .innerJoin(user, eq(member.userId, user.id))
-        .where(eq(member.organizationId, organizationId))
-      const memberUserIdByEmail = new Map(
-        existingMembers.map((m) => [m.userEmail.toLowerCase(), m.userId])
-      )
-      const newEmails = processedEmails.filter((email) => !memberUserIdByEmail.has(email))
-      const memberEmails = processedEmails.filter((email) => memberUserIdByEmail.has(email))
-
-      const existingInvitations = await db
-        .select({ email: invitation.email })
-        .from(invitation)
-        .where(and(eq(invitation.organizationId, organizationId), eq(invitation.status, 'pending')))
-      const pendingEmails = existingInvitations.map((i) => i.email.toLowerCase())
-      const emailsToInvite = newEmails.filter((email) => !pendingEmails.includes(email))
-
-      /**
-       * Existing organization members are not re-invited to the organization,
-       * but in batch mode they still receive a workspace invitation covering
-       * the selected workspaces they don't already have access to (or a
-       * pending invitation for). The inviter's own email is always treated as
-       * covered.
-       */
-      const memberWorkspaceInvites: Array<{ email: string; grants: WorkspaceGrantPayload[] }> = []
-      const membersAlreadyCovered: string[] = []
-
-      if (isBatch) {
-        const inviterEmail = session.user.email?.toLowerCase() ?? null
-        const eligibleMemberEmails = memberEmails.filter((email) => email !== inviterEmail)
-        membersAlreadyCovered.push(...memberEmails.filter((email) => email === inviterEmail))
-
-        const grantWorkspaceIds = validGrants.map((grant) => grant.workspaceId)
-        const eligibleMemberUserIds = eligibleMemberEmails.map(
-          (email) => memberUserIdByEmail.get(email) as string
-        )
-
-        const accessibleRows =
-          eligibleMemberUserIds.length > 0
-            ? await db
-                .select({ userId: permissions.userId, workspaceId: permissions.entityId })
-                .from(permissions)
-                .where(
-                  and(
-                    eq(permissions.entityType, 'workspace'),
-                    inArray(permissions.userId, eligibleMemberUserIds),
-                    inArray(permissions.entityId, grantWorkspaceIds)
-                  )
-                )
-            : []
-        const accessibleByUserId = new Map<string, Set<string>>()
-        for (const row of accessibleRows) {
-          const workspaceIds = accessibleByUserId.get(row.userId) ?? new Set<string>()
-          workspaceIds.add(row.workspaceId)
-          accessibleByUserId.set(row.userId, workspaceIds)
-        }
-
-        const pendingGrantRows =
-          eligibleMemberEmails.length > 0
-            ? await db
-                .select({
-                  email: invitation.email,
-                  workspaceId: invitationWorkspaceGrant.workspaceId,
-                })
-                .from(invitationWorkspaceGrant)
-                .innerJoin(invitation, eq(invitation.id, invitationWorkspaceGrant.invitationId))
-                .where(
-                  and(
-                    inArray(invitationWorkspaceGrant.workspaceId, grantWorkspaceIds),
-                    inArray(invitation.email, eligibleMemberEmails),
-                    eq(invitation.status, 'pending')
-                  )
-                )
-            : []
-        const pendingWorkspaceIdsByEmail = new Map<string, Set<string>>()
-        for (const row of pendingGrantRows) {
-          const email = row.email.toLowerCase()
-          const workspaceIds = pendingWorkspaceIdsByEmail.get(email) ?? new Set<string>()
-          workspaceIds.add(row.workspaceId)
-          pendingWorkspaceIdsByEmail.set(email, workspaceIds)
-        }
-
-        for (const email of eligibleMemberEmails) {
-          const memberUserId = memberUserIdByEmail.get(email) as string
-          const accessibleWorkspaceIds = accessibleByUserId.get(memberUserId)
-          const pendingWorkspaceIds = pendingWorkspaceIdsByEmail.get(email)
-
-          const grantsNeeded = validGrants.filter(
-            (grant) =>
-              !accessibleWorkspaceIds?.has(grant.workspaceId) &&
-              !pendingWorkspaceIds?.has(grant.workspaceId)
-          )
-
-          if (grantsNeeded.length > 0) {
-            memberWorkspaceInvites.push({ email, grants: grantsNeeded })
-          } else {
-            membersAlreadyCovered.push(email)
-          }
-        }
-      } else {
-        membersAlreadyCovered.push(...memberEmails)
-      }
-
-      if (emailsToInvite.length === 0 && memberWorkspaceInvites.length === 0) {
-        const isSingleEmail = processedEmails.length === 1
-        const pendingInvitationEmails = processedEmails.filter((email) =>
-          pendingEmails.includes(email)
-        )
-
-        if (isSingleEmail) {
-          if (membersAlreadyCovered.length > 0) {
-            return NextResponse.json(
-              {
-                error: isBatch
-                  ? 'Failed to send invitation. User already has access or a pending invitation to every selected workspace.'
-                  : 'Failed to send invitation. User is already a part of the organization.',
-              },
-              { status: 400 }
-            )
-          }
-          if (pendingInvitationEmails.length > 0) {
-            return NextResponse.json(
-              {
-                error:
-                  'Failed to send invitation. A pending invitation already exists for this email.',
-              },
-              { status: 400 }
-            )
-          }
-        }
-
-        return NextResponse.json(
-          {
-            error: isBatch
-              ? 'All emails are already members with access to the selected workspaces or have pending invitations.'
-              : 'All emails are already members or have pending invitations.',
-            details: {
-              existingMembers: membersAlreadyCovered,
-              pendingInvitations: pendingInvitationEmails,
-            },
-          },
-          { status: 400 }
-        )
-      }
-
-      const orgSubscription = await getOrganizationSubscription(organizationId)
-      const enforceFixedSeats = !!orgSubscription && isEnterprise(orgSubscription.plan)
-      const seatValidation =
-        enforceFixedSeats && emailsToInvite.length > 0
-          ? await validateSeatAvailability(organizationId, emailsToInvite.length)
-          : null
-      if (seatValidation && !seatValidation.canInvite) {
-        return NextResponse.json(
-          {
-            error: seatValidation.reason,
-            seatInfo: {
-              currentSeats: seatValidation.currentSeats,
-              maxSeats: seatValidation.maxSeats,
-              availableSeats: seatValidation.availableSeats,
-              seatsRequested: emailsToInvite.length,
-            },
-          },
-          { status: 400 }
-        )
-      }
-
-      const [inviterRow] = await db
-        .select({ name: user.name, email: user.email })
-        .from(user)
-        .where(eq(user.id, session.user.id))
-        .limit(1)
-      const inviterName = inviterRow?.name || inviterRow?.email || 'A user'
-
-      const failedInvitations: Array<{ email: string; error: string }> = []
-
-      /**
-       * Brand-new emails receive an organization invitation (with all selected
-       * workspace grants) that still requires acceptance — accepting is what
-       * joins them to the org and consumes a seat.
-       */
-      const sentInvitations: Array<{ id: string; email: string; workspaceIds: string[] }> = []
-
-      for (const email of emailsToInvite) {
-        try {
-          const { invitationId, token } = await createPendingInvitation({
-            kind: 'organization',
-            email,
-            inviterId: session.user.id,
-            organizationId,
-            membershipIntent: 'internal',
-            role,
-            grants: validGrants,
-          })
-
-          const emailResult = await sendInvitationEmail({
-            invitationId,
-            token,
-            kind: 'organization',
-            email,
-            inviterName,
-            organizationId,
-            organizationRole: role,
-            grants: validGrants,
-          })
-
-          if (!emailResult.success) {
-            logger.error('Failed to send invitation email', {
-              email,
-              error: emailResult.error,
-            })
-            failedInvitations.push({
-              email,
-              error: emailResult.error || 'Unknown email delivery error',
-            })
-            await cancelPendingInvitation(invitationId)
-            continue
-          }
-
-          sentInvitations.push({
-            id: invitationId,
-            email,
-            workspaceIds: validGrants.map((grant) => grant.workspaceId),
-          })
-        } catch (creationError) {
-          logger.error('Failed to create invitation', {
-            email,
-            error: creationError,
-          })
-          failedInvitations.push({
-            email,
-            error: getErrorMessage(creationError, 'Failed to create invitation'),
-          })
-        }
-      }
-
-      /**
-       * Existing organization members are granted workspace access directly —
-       * no invitation, no acceptance step. They are already in the org, so no
-       * seat is consumed. The grant is idempotent and upgrades lower access.
-       */
-      const directlyAdded: string[] = []
-
-      for (const memberInvite of memberWorkspaceInvites) {
-        const memberUserId = memberUserIdByEmail.get(memberInvite.email)
-        if (!memberUserId) continue
-
-        let addedAny = false
-        let lastGrantError: string | null = null
-        for (const grant of memberInvite.grants) {
-          try {
-            const grantResult = await grantWorkspaceAccessDirectly({
-              userId: memberUserId,
-              email: memberInvite.email,
-              workspaceId: grant.workspaceId,
-              workspaceName: workspaceNameById.get(grant.workspaceId) ?? 'a workspace',
-              permission: grant.permission,
-              organizationId,
-              actorId: session.user.id,
-              actorName: inviterName,
-              actorEmail: session.user.email,
-              request,
-            })
-
-            if (grantResult.outcome === 'added') addedAny = true
-          } catch (grantError) {
-            logger.error('Failed to grant workspace access directly', {
-              email: memberInvite.email,
-              workspaceId: grant.workspaceId,
-              error: grantError,
-            })
-            lastGrantError = getErrorMessage(grantError, 'Failed to add member to workspace')
-          }
-        }
-
-        if (addedAny) {
-          directlyAdded.push(memberInvite.email)
-        } else if (lastGrantError) {
-          failedInvitations.push({ email: memberInvite.email, error: lastGrantError })
-        }
-      }
-
-      for (const inv of sentInvitations) {
-        recordAudit({
-          workspaceId: null,
-          actorId: session.user.id,
-          action: AuditAction.ORG_INVITATION_CREATED,
-          resourceType: AuditResourceType.ORGANIZATION,
-          resourceId: organizationId,
-          actorName: session.user.name ?? undefined,
-          actorEmail: session.user.email ?? undefined,
-          resourceName: organizationEntry.name,
-          description: `Invited ${inv.email} to organization as ${role}`,
-          metadata: {
-            invitationId: inv.id,
-            targetEmail: inv.email,
-            targetRole: role,
-            isBatch,
-            workspaceGrantCount: validGrants.length,
-            enforcedFixedSeats: enforceFixedSeats,
-            plan: orgSubscription?.plan ?? null,
-          },
-          request,
-        })
-      }
-
-      const totalInvitationsSent = sentInvitations.length
-      const totalSucceeded = totalInvitationsSent + directlyAdded.length
-      const responseData = {
-        invitationsSent: totalInvitationsSent,
-        invitedEmails: sentInvitations.map((inv) => inv.email),
-        directlyAdded,
-        directlyAddedCount: directlyAdded.length,
-        failedInvitations,
-        existingMembers: membersAlreadyCovered,
-        pendingInvitations: processedEmails.filter(
-          (email) => pendingEmails.includes(email) && !memberUserIdByEmail.has(email)
-        ),
-        invalidEmails: invitationEmails.filter(
-          (email) => !quickValidateEmail(normalizeEmail(email)).isValid
-        ),
-        workspaceGrantsPerInvite: validGrants.length,
-        ...(seatValidation
-          ? {
-              seatInfo: {
-                seatsUsed: seatValidation.currentSeats + totalInvitationsSent,
-                maxSeats: seatValidation.maxSeats,
-                availableSeats: seatValidation.availableSeats - totalInvitationsSent,
-              },
-            }
-          : {}),
-      }
-
-      const summaryParts: string[] = []
-      if (totalInvitationsSent > 0) summaryParts.push(`${totalInvitationsSent} invitation(s) sent`)
-      if (directlyAdded.length > 0) summaryParts.push(`${directlyAdded.length} member(s) added`)
-      const summary = summaryParts.join(', ')
-
-      if (failedInvitations.length > 0 && totalSucceeded === 0) {
-        return NextResponse.json(
-          {
-            success: false,
-            error: 'Failed to send invitations.',
-            message: 'No invitations could be delivered.',
-            data: responseData,
-          },
-          { status: 502 }
-        )
-      }
-
-      if (failedInvitations.length > 0) {
-        return NextResponse.json(
-          {
-            success: false,
-            error: 'Some invitations failed.',
-            message: `${summary}, ${failedInvitations.length} failed`,
-            data: responseData,
-          },
-          { status: 207 }
-        )
-      }
-
-      return NextResponse.json({
-        success: true,
-        message: `${summary || 'No changes'} successfully`,
-        data: responseData,
-      })
-    } catch (error) {
-      if (error instanceof InvitationsNotAllowedError) {
-        return NextResponse.json({ error: error.message }, { status: 403 })
-      }
-      logger.error('Failed to create organization invitations', { error })
-      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-    }
-  }
-)
diff --git a/apps/sim/app/api/organizations/[id]/members/route.ts b/apps/sim/app/api/organizations/[id]/members/route.ts
index 74cb552e8e7..416d5c3ba03 100644
--- a/apps/sim/app/api/organizations/[id]/members/route.ts
+++ b/apps/sim/app/api/organizations/[id]/members/route.ts
@@ -1,38 +1,18 @@
-import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import {
-  invitation,
-  member,
-  subscription as subscriptionTable,
-  user,
-  userStats,
-} from '@sim/db/schema'
+import { member, subscription as subscriptionTable, user, userStats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { isOrgAdminRole } from '@sim/platform-authz/workspace'
-import { normalizeEmail } from '@sim/utils/string'
 import { and, eq, inArray } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import {
-  inviteOrganizationMemberContract,
   organizationMemberQuerySchema,
   organizationParamsSchema,
 } from '@/lib/api/contracts/organization'
-import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { getValidationErrorMessage } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { getOrgMemberLedgerByUser } from '@/lib/billing/core/organization'
 import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
-import { validateSeatAvailability } from '@/lib/billing/validation/seat-management'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import {
-  cancelPendingInvitation,
-  createPendingInvitation,
-  sendInvitationEmail,
-} from '@/lib/invitations/send'
-import { quickValidateEmail } from '@/lib/messaging/email/validation'
-import {
-  InvitationsNotAllowedError,
-  validateInvitationsAllowed,
-} from '@/ee/access-control/utils/permission-check'
 
 const logger = createLogger('OrganizationMembersAPI')
 
@@ -189,192 +169,3 @@ export const GET = withRouteHandler(
     }
   }
 )
-
-/**
- * POST /api/organizations/[id]/members
- * Invite new member to organization
- */
-export const POST = withRouteHandler(
-  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
-    try {
-      const session = await getSession()
-
-      if (!session?.user?.id) {
-        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-      }
-
-      const parsed = await parseRequest(inviteOrganizationMemberContract, request, context)
-      if (!parsed.success) return parsed.response
-
-      const { id: organizationId } = parsed.data.params
-
-      await validateInvitationsAllowed(session.user.id, { organizationId })
-
-      const { email, role = 'member' } = parsed.data.body
-
-      // Validate and normalize email
-      const normalizedEmail = normalizeEmail(email)
-      const validation = quickValidateEmail(normalizedEmail)
-      if (!validation.isValid) {
-        return NextResponse.json(
-          { error: validation.reason || 'Invalid email format' },
-          { status: 400 }
-        )
-      }
-
-      // Verify user has admin access
-      const memberEntry = await db
-        .select()
-        .from(member)
-        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
-        .limit(1)
-
-      if (memberEntry.length === 0) {
-        return NextResponse.json(
-          { error: 'Forbidden - Not a member of this organization' },
-          { status: 403 }
-        )
-      }
-
-      if (!isOrgAdminRole(memberEntry[0].role)) {
-        return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
-      }
-
-      // Check seat availability
-      const seatValidation = await validateSeatAvailability(organizationId, 1)
-      if (!seatValidation.canInvite) {
-        return NextResponse.json(
-          {
-            error: `Cannot invite teammate. Using ${seatValidation.currentSeats} of ${seatValidation.maxSeats} seats.`,
-            details: seatValidation,
-          },
-          { status: 400 }
-        )
-      }
-
-      // Check if user is already a member
-      const existingUser = await db
-        .select({ id: user.id })
-        .from(user)
-        .where(eq(user.email, normalizedEmail))
-        .limit(1)
-
-      if (existingUser.length > 0) {
-        const existingMember = await db
-          .select()
-          .from(member)
-          .where(
-            and(eq(member.organizationId, organizationId), eq(member.userId, existingUser[0].id))
-          )
-          .limit(1)
-
-        if (existingMember.length > 0) {
-          return NextResponse.json(
-            { error: 'User is already a member of this organization' },
-            { status: 400 }
-          )
-        }
-      }
-
-      // Check for existing pending invitation
-      const existingInvitation = await db
-        .select()
-        .from(invitation)
-        .where(
-          and(
-            eq(invitation.organizationId, organizationId),
-            eq(invitation.email, normalizedEmail),
-            eq(invitation.status, 'pending')
-          )
-        )
-        .limit(1)
-
-      if (existingInvitation.length > 0) {
-        return NextResponse.json(
-          { error: 'Pending invitation already exists for this email' },
-          { status: 400 }
-        )
-      }
-
-      const { invitationId, token } = await createPendingInvitation({
-        kind: 'organization',
-        email: normalizedEmail,
-        inviterId: session.user.id,
-        organizationId,
-        role,
-        grants: [],
-      })
-
-      const [inviterRow] = await db
-        .select({ name: user.name, email: user.email })
-        .from(user)
-        .where(eq(user.id, session.user.id))
-        .limit(1)
-      const inviterName = inviterRow?.name || inviterRow?.email || 'A user'
-
-      const emailResult = await sendInvitationEmail({
-        invitationId,
-        token,
-        kind: 'organization',
-        email: normalizedEmail,
-        inviterName,
-        organizationId,
-        organizationRole: role,
-        grants: [],
-      })
-
-      if (!emailResult.success) {
-        logger.error('Failed to send organization invitation email', {
-          email: normalizedEmail,
-          invitationId,
-          error: emailResult.error,
-        })
-        await cancelPendingInvitation(invitationId)
-        return NextResponse.json(
-          { error: emailResult.error || 'Failed to send invitation email' },
-          { status: 502 }
-        )
-      }
-
-      logger.info('Member invitation sent', {
-        email: normalizedEmail,
-        organizationId,
-        invitationId,
-        role,
-      })
-
-      recordAudit({
-        workspaceId: null,
-        actorId: session.user.id,
-        action: AuditAction.ORG_INVITATION_CREATED,
-        resourceType: AuditResourceType.ORGANIZATION,
-        resourceId: organizationId,
-        actorName: session.user.name ?? undefined,
-        actorEmail: session.user.email ?? undefined,
-        description: `Invited ${normalizedEmail} to organization as ${role}`,
-        metadata: { invitationId, targetEmail: normalizedEmail, targetRole: role },
-        request,
-      })
-
-      return NextResponse.json({
-        success: true,
-        message: `Invitation sent to ${normalizedEmail}`,
-        data: {
-          invitationId,
-          email: normalizedEmail,
-          role,
-        },
-      })
-    } catch (error) {
-      if (error instanceof InvitationsNotAllowedError) {
-        return NextResponse.json({ error: error.message }, { status: 403 })
-      }
-      logger.error('Failed to invite organization member', {
-        organizationId: (await context.params).id,
-        error,
-      })
-
-      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-    }
-  }
-)
diff --git a/apps/sim/app/api/organizations/[id]/removal-impact/route.ts b/apps/sim/app/api/organizations/[id]/removal-impact/route.ts
new file mode 100644
index 00000000000..8b3e9c8a3a9
--- /dev/null
+++ b/apps/sim/app/api/organizations/[id]/removal-impact/route.ts
@@ -0,0 +1,52 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { getMemberRemovalImpactContract } from '@/lib/api/contracts/organization'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
+import { getOrganizationTransferCredentialDependencies } from '@/lib/billing/organizations/membership'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('OrganizationRemovalImpactAPI')
+
+/**
+ * Identity-bound credentials the target user owns in this organization's
+ * workspaces — the set that stops working when their workspace access is
+ * revoked. Readable by org admins (removing someone) and by the user
+ * themself (leaving).
+ */
+export const GET = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const parsed = await parseRequest(getMemberRemovalImpactContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: organizationId } = parsed.data.params
+    const { userId: targetUserId } = parsed.data.query
+
+    try {
+      const isSelf = targetUserId === session.user.id
+      if (!isSelf && !(await isOrganizationOwnerOrAdmin(session.user.id, organizationId))) {
+        return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
+      }
+
+      const credentials = await getOrganizationTransferCredentialDependencies(
+        targetUserId,
+        organizationId
+      )
+
+      return NextResponse.json({ credentials })
+    } catch (error) {
+      logger.error('Failed to compute member removal impact', {
+        organizationId,
+        targetUserId,
+        error,
+      })
+      return NextResponse.json({ error: 'Failed to compute removal impact' }, { status: 500 })
+    }
+  }
+)
diff --git a/apps/sim/app/api/organizations/route.test.ts b/apps/sim/app/api/organizations/route.test.ts
index bbe8e36990e..a0e076b22dc 100644
--- a/apps/sim/app/api/organizations/route.test.ts
+++ b/apps/sim/app/api/organizations/route.test.ts
@@ -96,6 +96,7 @@ describe('POST /api/organizations', () => {
     expect(mockAttachOwnedWorkspacesToOrganization).toHaveBeenCalledWith({
       ownerUserId: 'user-1',
       organizationId: 'legacy-org-id',
+      includeArchived: true,
     })
     expect(mockCreateOrganizationForTeamPlan).not.toHaveBeenCalled()
     expect(mockEnsureOrganizationForTeamSubscription).not.toHaveBeenCalled()
diff --git a/apps/sim/app/api/organizations/route.ts b/apps/sim/app/api/organizations/route.ts
index 839ff3c7617..52ab9783236 100644
--- a/apps/sim/app/api/organizations/route.ts
+++ b/apps/sim/app/api/organizations/route.ts
@@ -186,9 +186,18 @@ export const POST = withRouteHandler(async (request: Request) => {
       organizationId = existingAdminMembership.organizationId
 
       if (activeOrgSubscription.referenceId === organizationId) {
+        /**
+         * Keeps the default `reject` policy: manual organization creation
+         * surfaces a different-org collaborator as an explicit conflict (409
+         * with actionable copy) rather than silently demoting them to an
+         * external member. Safe alongside `includeArchived` because the attach
+         * only enumerates collaborators of ACTIVE workspaces, so sweeping
+         * archived rows cannot manufacture a conflict.
+         */
         await attachOwnedWorkspacesToOrganization({
           ownerUserId: user.id,
           organizationId,
+          includeArchived: true,
         })
       } else {
         const resolvedSubscription =
diff --git a/apps/sim/app/api/v1/admin/organizations/[id]/members/route.ts b/apps/sim/app/api/v1/admin/organizations/[id]/members/route.ts
index 5f77c3aa1e9..fef6b78a576 100644
--- a/apps/sim/app/api/v1/admin/organizations/[id]/members/route.ts
+++ b/apps/sim/app/api/v1/admin/organizations/[id]/members/route.ts
@@ -11,10 +11,11 @@
  *
  * POST /api/v1/admin/organizations/[id]/members
  *
- * Add a user to an organization with full billing logic.
- * Validates seat availability before adding (uses same logic as invitation flow):
- *   - Team plans: checks seats column
- *   - Enterprise plans: checks metadata.seats
+ * Add a user to an organization with full billing logic, matching invitation
+ * acceptance:
+ *   - Enterprise: the fixed `metadata.seats` cap is enforced before adding.
+ *   - Team: seats are elastic, so no cap is checked and the subscription is
+ *     grown to the new member count afterwards.
  * Handles Pro usage snapshot and subscription cancellation like the invitation flow.
  * If user is already a member, updates their role if different.
  *
@@ -30,7 +31,7 @@
 
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { member, organization, user, userStats } from '@sim/db/schema'
+import { member, organization, user, userStats, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { count, eq } from 'drizzle-orm'
 import {
@@ -38,10 +39,19 @@ import {
   adminV1ListOrganizationMembersContract,
 } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
+import { getOrganizationSubscription } from '@/lib/billing/core/billing'
 import { getOrgMemberLedgerByUser } from '@/lib/billing/core/organization'
-import { addUserToOrganization } from '@/lib/billing/organizations/membership'
+import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
+import { ensureUserInOrganizationTx } from '@/lib/billing/organizations/membership'
+import { reconcileOrganizationSeats } from '@/lib/billing/organizations/seats'
+import { isEnterprise } from '@/lib/billing/plan-helpers'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { acquireInvitationMutationLocks } from '@/lib/invitations/locks'
+import {
+  attachOwnedWorkspacesToOrganizationTx,
+  ownedAttachableWorkspacesWhere,
+} from '@/lib/workspaces/organization-workspaces'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   adminInvalidJsonResponse,
@@ -58,6 +68,18 @@ import {
   createPaginationMeta,
 } from '@/app/api/v1/admin/types'
 
+/**
+ * The target's owned-workspace set changed between the advisory-lock capture
+ * and the membership commit; the add is aborted so no workspace escapes the
+ * sweep. Safe to retry immediately.
+ */
+class WorkspaceSetChangedDuringAddError extends Error {
+  constructor() {
+    super('Owned workspaces changed while adding the member')
+    this.name = 'WorkspaceSetChangedDuringAddError'
+  }
+}
+
 const logger = createLogger('AdminOrganizationMembersAPI')
 
 interface RouteParams {
@@ -253,19 +275,137 @@ export const POST = withRouteHandler(
         )
       }
 
-      const result = await addUserToOrganization({
-        userId,
-        organizationId,
-        role,
-        skipBillingLogic: !isBillingEnabled,
+      /**
+       * Membership and the workspace sweep commit or roll back together:
+       * every workspace the new member owns follows them into the org
+       * (collaborators stay external), and an attach failure aborts the whole
+       * add instead of leaving a member whose workspaces escaped the sweep.
+       * Lock order mirrors invitation acceptance: workspace advisory locks
+       * first, then the organization lock inside ensureUserInOrganizationTx.
+       */
+      const organizationSubscription = isBillingEnabled
+        ? await getOrganizationSubscription(organizationId)
+        : null
+      const organizationHasFixedSeats = isEnterprise(organizationSubscription?.plan)
+
+      const result = await db.transaction(async (tx) => {
+        const ownedWorkspaceIds = (
+          await tx
+            .select({ id: workspace.id })
+            .from(workspace)
+            .where(ownedAttachableWorkspacesWhere({ userId, includeArchived: true }))
+        ).map((row) => row.id)
+        if (ownedWorkspaceIds.length > 0) {
+          await acquireInvitationMutationLocks(tx, {
+            invitationIds: [],
+            workspaceIds: ownedWorkspaceIds,
+          })
+        }
+
+        /**
+         * Only Enterprise has a seat cap to enforce. Team seats are elastic —
+         * `reconcileOrganizationSeats` sets `subscription.seats` to exactly the
+         * member count, so validating against it would compare N members to N
+         * seats and reject every add. Invitation acceptance skips the check for
+         * the same reason; this path must agree or the two disagree on whether a
+         * Team org has room.
+         */
+        const membership = await ensureUserInOrganizationTx(tx, {
+          userId,
+          organizationId,
+          role,
+          skipBillingLogic: !isBillingEnabled,
+          skipSeatValidation: isBillingEnabled && !organizationHasFixedSeats,
+        })
+        if (!membership.success || !membership.memberId || membership.alreadyMember) {
+          return { membership, attachedWorkspaceIds: [], usageLimitUserIds: [] }
+        }
+
+        /**
+         * ensureUserInOrganizationTx holds the user's billing-identity lock,
+         * which personal workspace creation also takes — so re-reading the
+         * owned set here is race-free. A set that changed since the pre-lock
+         * capture means a workspace escaped the advisory-lock plan: abort the
+         * whole add (rolling back the membership) rather than committing a
+         * member whose workspace dodged the sweep.
+         */
+        const currentOwnedIds = (
+          await tx
+            .select({ id: workspace.id })
+            .from(workspace)
+            .where(ownedAttachableWorkspacesWhere({ userId, includeArchived: true }))
+        ).map((row) => row.id)
+        if ([...currentOwnedIds].sort().join() !== [...ownedWorkspaceIds].sort().join()) {
+          throw new WorkspaceSetChangedDuringAddError()
+        }
+
+        if (ownedWorkspaceIds.length === 0) {
+          return { membership, attachedWorkspaceIds: [], usageLimitUserIds: [] }
+        }
+        const attach = await attachOwnedWorkspacesToOrganizationTx(tx, {
+          ownerUserId: userId,
+          organizationId,
+          workspaceIds: ownedWorkspaceIds,
+          externalMemberPolicy: 'external-all',
+          ownerMatch: 'owner',
+          includeArchived: true,
+        })
+        return {
+          membership,
+          attachedWorkspaceIds: attach.attachedWorkspaceIds,
+          usageLimitUserIds: attach.usageLimitUserIds,
+        }
       })
 
-      if (!result.success) {
-        return badRequestResponse(result.error || 'Failed to add member')
+      if (!result.membership.success || !result.membership.memberId) {
+        return badRequestResponse(result.membership.error || 'Failed to add member')
+      }
+      if (result.membership.alreadyMember) {
+        return badRequestResponse('User is already a member of this organization')
+      }
+
+      /**
+       * Team seats are billed per member, so a committed add has to grow the
+       * subscription — acceptance does this post-commit and best-effort, and the
+       * drift sweep is the backstop if it fails. Enterprise has a fixed
+       * allotment and is skipped inside the reconcile.
+       */
+      if (isBillingEnabled && !organizationHasFixedSeats) {
+        try {
+          await reconcileOrganizationSeats({
+            organizationId,
+            reason: 'admin-member-added',
+          })
+        } catch (seatError) {
+          logger.error('Failed to reconcile seats after admin member add', {
+            userId,
+            organizationId,
+            error: seatError,
+          })
+        }
+      }
+
+      if (result.attachedWorkspaceIds.length > 0) {
+        logger.info('Attached new member workspaces to organization', {
+          userId,
+          organizationId,
+          attachedWorkspaceCount: result.attachedWorkspaceIds.length,
+        })
+      }
+      for (const limitUserId of new Set(result.usageLimitUserIds)) {
+        try {
+          await syncUsageLimitsFromSubscription(limitUserId)
+        } catch (syncError) {
+          logger.error('Failed to sync usage limits after admin member add', {
+            userId: limitUserId,
+            organizationId,
+            error: syncError,
+          })
+        }
       }
 
       const data: AdminMember = {
-        id: result.memberId!,
+        id: result.membership.memberId,
         userId,
         organizationId,
         role,
@@ -276,8 +416,9 @@ export const POST = withRouteHandler(
 
       logger.info(`Admin API: Added user ${userId} to organization ${organizationId}`, {
         role,
-        memberId: result.memberId,
-        billingActions: result.billingActions,
+        memberId: result.membership.memberId,
+        billingActions: result.membership.billingActions,
+        attachedWorkspaceCount: result.attachedWorkspaceIds.length,
       })
 
       recordAudit({
@@ -287,7 +428,12 @@ export const POST = withRouteHandler(
         resourceType: AuditResourceType.ORGANIZATION,
         resourceId: organizationId,
         description: `Admin API added member to organization as ${role}`,
-        metadata: { targetUserId: userId, role, memberId: result.memberId },
+        metadata: {
+          targetUserId: userId,
+          role,
+          memberId: result.membership.memberId,
+          attachedWorkspaceIds: result.attachedWorkspaceIds,
+        },
         request,
       })
 
@@ -295,11 +441,16 @@ export const POST = withRouteHandler(
         ...data,
         action: 'created' as const,
         billingActions: {
-          proUsageSnapshotted: result.billingActions.proUsageSnapshotted,
-          proCancelledAtPeriodEnd: result.billingActions.proCancelledAtPeriodEnd,
+          proUsageSnapshotted: result.membership.billingActions.proUsageSnapshotted,
+          proCancelledAtPeriodEnd: result.membership.billingActions.proCancelledAtPeriodEnd,
         },
       })
     } catch (error) {
+      if (error instanceof WorkspaceSetChangedDuringAddError) {
+        return badRequestResponse(
+          "The user's workspaces changed while adding them — retry the add."
+        )
+      }
       logger.error('Admin API: Failed to add organization member', { error, organizationId })
       return internalErrorResponse('Failed to add organization member')
     }
diff --git a/apps/sim/app/api/workspaces/invitations/batch/route.ts b/apps/sim/app/api/workspaces/invitations/batch/route.ts
index 391a1cb8952..f41989b9c8e 100644
--- a/apps/sim/app/api/workspaces/invitations/batch/route.ts
+++ b/apps/sim/app/api/workspaces/invitations/batch/route.ts
@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { normalizeEmail } from '@sim/utils/string'
 import { type NextRequest, NextResponse } from 'next/server'
 import { batchWorkspaceInvitationsContract } from '@/lib/api/contracts/invitations'
@@ -54,7 +55,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
     const { body } = parsed.data
 
     const context = await prepareWorkspaceInvitationContext({
-      workspaceId: body.workspaceId,
+      workspaceIds: body.workspaceIds,
       inviterId: session.user.id,
       inviterName: session.user.name || session.user.email || 'A user',
       inviterEmail: session.user.email,
@@ -66,8 +67,8 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
     const invitations: WorkspaceInvitationResult[] = []
     const seenEmails = new Set<string>()
 
-    for (const item of body.invitations) {
-      const normalizedEmail = normalizeEmail(item.email)
+    for (const rawEmail of body.emails) {
+      const normalizedEmail = normalizeEmail(rawEmail)
       if (seenEmails.has(normalizedEmail)) {
         failed.push({
           email: normalizedEmail,
@@ -80,8 +81,9 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       try {
         const invitation = await createWorkspaceInvitation({
           context,
-          email: item.email,
-          permission: item.permission,
+          email: rawEmail,
+          permission: body.permission,
+          membership: body.membership,
           request: req,
         })
         if (invitation.instantAdd) {
@@ -98,11 +100,19 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
           continue
         }
 
+        /**
+         * One bad address must not discard the invitations that already
+         * succeeded, so unexpected failures are reported per email rather than
+         * aborting the batch.
+         */
         logger.error('Unexpected workspace invitation batch item failure:', {
           email: normalizedEmail,
           error,
         })
-        throw error
+        failed.push({
+          email: normalizedEmail,
+          error: getErrorMessage(error, 'Failed to create invitation'),
+        })
       }
     }
 
diff --git a/apps/sim/app/api/workspaces/invitations/route.test.ts b/apps/sim/app/api/workspaces/invitations/route.test.ts
index 2b600626204..2d8abced766 100644
--- a/apps/sim/app/api/workspaces/invitations/route.test.ts
+++ b/apps/sim/app/api/workspaces/invitations/route.test.ts
@@ -10,7 +10,9 @@ import {
   posthogServerMock,
   queueTableRows,
   resetDbChainMock,
+  resetEnvFlagsMock,
   schemaMock,
+  setEnvFlags,
 } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -22,7 +24,9 @@ const {
   mockCreatePendingInvitation,
   mockSendInvitationEmail,
   mockCancelPendingInvitation,
-  mockFindPendingGrantForWorkspaceEmail,
+  mockRevertPendingInvitationGrants,
+  mockFindPendingGrantWorkspaceIds,
+  mockGetInvitePlanCategoryForUser,
 } = vi.hoisted(() => ({
   mockGetWorkspaceInvitePolicy: vi.fn(),
   mockValidateInvitationsAllowed: vi.fn().mockResolvedValue(undefined),
@@ -31,13 +35,16 @@ const {
   mockCreatePendingInvitation: vi.fn(),
   mockSendInvitationEmail: vi.fn(),
   mockCancelPendingInvitation: vi.fn(),
-  mockFindPendingGrantForWorkspaceEmail: vi.fn(),
+  mockRevertPendingInvitationGrants: vi.fn(),
+  mockFindPendingGrantWorkspaceIds: vi.fn(),
+  mockGetInvitePlanCategoryForUser: vi.fn(),
 }))
 
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 
 vi.mock('@/lib/workspaces/policy', () => ({
   getWorkspaceInvitePolicy: mockGetWorkspaceInvitePolicy,
+  getInvitePlanCategoryForUser: mockGetInvitePlanCategoryForUser,
   isOrganizationWorkspace: (ws: {
     workspaceMode?: string | null
     organizationId?: string | null
@@ -56,7 +63,8 @@ vi.mock('@/lib/invitations/send', () => ({
   createPendingInvitation: mockCreatePendingInvitation,
   sendInvitationEmail: mockSendInvitationEmail,
   cancelPendingInvitation: mockCancelPendingInvitation,
-  findPendingGrantForWorkspaceEmail: mockFindPendingGrantForWorkspaceEmail,
+  revertPendingInvitationGrants: mockRevertPendingInvitationGrants,
+  findPendingGrantWorkspaceIds: mockFindPendingGrantWorkspaceIds,
 }))
 
 vi.mock('@/lib/invitations/core', () => ({
@@ -85,6 +93,8 @@ const mockGetWorkspaceWithOwner = permissionsMockFns.mockGetWorkspaceWithOwner
 import { UPGRADE_TO_INVITE_REASON } from '@/lib/workspaces/policy-constants'
 import { POST } from '@/app/api/workspaces/invitations/batch/route'
 
+afterAll(resetEnvFlagsMock)
+
 describe('POST /api/workspaces/invitations/batch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -116,13 +126,19 @@ describe('POST /api/workspaces/invitations/batch', () => {
       availableSeats: 4,
     })
     mockGetUserOrganization.mockResolvedValue(null)
-    mockCreatePendingInvitation.mockResolvedValue({
-      invitationId: 'inv-1',
-      token: 'tok-1',
-      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
-    })
+    mockCreatePendingInvitation.mockImplementation(
+      async (input: { grants: Array<{ workspaceId: string; permission: string }> }) => ({
+        invitationId: 'inv-1',
+        token: 'tok-1',
+        expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+        created: true,
+        addedWorkspaceIds: input.grants.map((grant) => grant.workspaceId),
+        grants: input.grants,
+      })
+    )
     mockSendInvitationEmail.mockResolvedValue({ success: true })
-    mockFindPendingGrantForWorkspaceEmail.mockResolvedValue(null)
+    mockFindPendingGrantWorkspaceIds.mockResolvedValue(new Set())
+    mockGetInvitePlanCategoryForUser.mockResolvedValue('free')
   })
 
   afterAll(() => {
@@ -147,8 +163,9 @@ describe('POST /api/workspaces/invitations/batch', () => {
     })
 
     const request = createMockRequest('POST', {
-      workspaceId: 'workspace-1',
-      invitations: [{ email: 'new@example.com', permission: 'read' }],
+      workspaceIds: ['workspace-1'],
+      emails: ['new@example.com'],
+      permission: 'read',
     })
 
     const response = await POST(request)
@@ -177,8 +194,9 @@ describe('POST /api/workspaces/invitations/batch', () => {
     })
 
     const request = createMockRequest('POST', {
-      workspaceId: 'workspace-1',
-      invitations: [{ email: 'new@example.com', permission: 'read' }],
+      workspaceIds: ['workspace-1'],
+      emails: ['new@example.com'],
+      permission: 'read',
     })
 
     const response = await POST(request)
@@ -214,8 +232,9 @@ describe('POST /api/workspaces/invitations/batch', () => {
     })
 
     const request = createMockRequest('POST', {
-      workspaceId: 'workspace-1',
-      invitations: [{ email: 'new@example.com', permission: 'read' }],
+      workspaceIds: ['workspace-1'],
+      emails: ['new@example.com'],
+      permission: 'read',
     })
 
     const response = await POST(request)
@@ -257,8 +276,9 @@ describe('POST /api/workspaces/invitations/batch', () => {
     queueTableRows(schemaMock.user, [{ id: 'existing-user', email: 'new@example.com' }])
 
     const request = createMockRequest('POST', {
-      workspaceId: 'workspace-1',
-      invitations: [{ email: 'new@example.com', permission: 'read' }],
+      workspaceIds: ['workspace-1'],
+      emails: ['new@example.com'],
+      permission: 'read',
     })
 
     const response = await POST(request)
@@ -290,8 +310,9 @@ describe('POST /api/workspaces/invitations/batch', () => {
     })
 
     const request = createMockRequest('POST', {
-      workspaceId: 'workspace-1',
-      invitations: [{ email: 'new@example.com', permission: 'write' }],
+      workspaceIds: ['workspace-1'],
+      emails: ['new@example.com'],
+      permission: 'write',
     })
 
     const response = await POST(request)
@@ -312,24 +333,10 @@ describe('POST /api/workspaces/invitations/batch', () => {
   })
 
   it('creates multiple workspace invitations in one batch request', async () => {
-    mockCreatePendingInvitation
-      .mockResolvedValueOnce({
-        invitationId: 'inv-1',
-        token: 'tok-1',
-        expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
-      })
-      .mockResolvedValueOnce({
-        invitationId: 'inv-2',
-        token: 'tok-2',
-        expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
-      })
-
     const request = createMockRequest('POST', {
-      workspaceId: 'workspace-1',
-      invitations: [
-        { email: 'first@example.com', permission: 'read' },
-        { email: 'second@example.com', permission: 'write' },
-      ],
+      workspaceIds: ['workspace-1'],
+      emails: ['first@example.com', 'second@example.com'],
+      permission: 'read',
     })
 
     const response = await POST(request)
@@ -344,6 +351,90 @@ describe('POST /api/workspaces/invitations/batch', () => {
     expect(mockSendInvitationEmail).toHaveBeenCalledTimes(2)
   })
 
+  it('coalesces several workspaces into one invitation and one email', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Org Workspace',
+      ownerId: 'user-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockGetWorkspaceInvitePolicy.mockResolvedValue({
+      allowed: true,
+      reason: null,
+      requiresSeat: false,
+      organizationId: 'org-1',
+      upgradeRequired: false,
+    })
+
+    const request = createMockRequest('POST', {
+      workspaceIds: ['workspace-1', 'workspace-2'],
+      emails: ['new@example.com'],
+      permission: 'write',
+    })
+
+    const response = await POST(request)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.success).toBe(true)
+    expect(mockCreatePendingInvitation).toHaveBeenCalledTimes(1)
+    expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
+      expect.objectContaining({
+        grants: [
+          { workspaceId: 'workspace-1', permission: 'write' },
+          { workspaceId: 'workspace-2', permission: 'write' },
+        ],
+      })
+    )
+    expect(mockSendInvitationEmail).toHaveBeenCalledTimes(1)
+    expect(data.invitations[0].workspaceIds).toEqual(['workspace-1', 'workspace-2'])
+  })
+
+  it('reports a per-email failure when an external invite targets a free account', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValueOnce({
+      id: 'workspace-1',
+      name: 'Org Workspace',
+      ownerId: 'user-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockGetWorkspaceInvitePolicy.mockResolvedValueOnce({
+      allowed: true,
+      reason: null,
+      requiresSeat: false,
+      organizationId: 'org-1',
+      upgradeRequired: false,
+    })
+    /**
+     * The paid-plan requirement is a billing rule, so it only applies when
+     * billing is on — with billing off there are no seats to protect and every
+     * account reads as free.
+     */
+    setEnvFlags({ isBillingEnabled: true })
+    queueTableRows(schemaMock.user, [{ id: 'free-user', email: 'free@example.com' }])
+    mockGetUserOrganization.mockResolvedValueOnce(null)
+    mockGetInvitePlanCategoryForUser.mockResolvedValueOnce('free')
+
+    const request = createMockRequest('POST', {
+      workspaceIds: ['workspace-1'],
+      emails: ['free@example.com'],
+      permission: 'write',
+      membership: 'external',
+    })
+
+    const response = await POST(request)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.success).toBe(false)
+    expect(data.failed[0].email).toBe('free@example.com')
+    expect(data.failed[0].error).toContain('not on a paid Sim plan')
+    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
+  })
+
   it('rolls back the unified invitation when email delivery fails', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValueOnce({
       id: 'workspace-1',
@@ -359,8 +450,9 @@ describe('POST /api/workspaces/invitations/batch', () => {
     })
 
     const request = createMockRequest('POST', {
-      workspaceId: 'workspace-1',
-      invitations: [{ email: 'new@example.com', permission: 'read' }],
+      workspaceIds: ['workspace-1'],
+      emails: ['new@example.com'],
+      permission: 'read',
     })
 
     const response = await POST(request)
diff --git a/apps/sim/app/api/workspaces/route.ts b/apps/sim/app/api/workspaces/route.ts
index e63aab34a02..f3bb86871a7 100644
--- a/apps/sim/app/api/workspaces/route.ts
+++ b/apps/sim/app/api/workspaces/route.ts
@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { permissions, type WorkspaceMode, workflow, workspace } from '@sim/db/schema'
+import { member, permissions, type WorkspaceMode, workflow, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { and, eq, isNull } from 'drizzle-orm'
@@ -10,6 +10,7 @@ import { createWorkspaceContract } from '@/lib/api/contracts/workspaces'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { getActiveOrganizationId } from '@/lib/auth/session-response'
+import { acquireUserBillingIdentityLock } from '@/lib/billing/organizations/billing-identity-lock'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { captureServerEvent } from '@/lib/posthog/server'
@@ -26,6 +27,17 @@ import {
 
 const logger = createLogger('Workspaces')
 
+/**
+ * Thrown when the creator became an organization member between the
+ * creation-policy read and the insert — the workspace must not land personal.
+ */
+class PersonalWorkspaceCreationRacedError extends Error {
+  constructor() {
+    super('User joined an organization while creating a personal workspace')
+    this.name = 'PersonalWorkspaceCreationRacedError'
+  }
+}
+
 // Get all workspaces for the current user
 export const GET = withRouteHandler(async (request: Request) => {
   const session = await getSession()
@@ -58,11 +70,32 @@ export const GET = withRouteHandler(async (request: Request) => {
       return NextResponse.json({ workspaces: [], lastActiveWorkspaceId, creationPolicy })
     }
 
-    const defaultWorkspace = await createDefaultWorkspace(
-      session.user.id,
-      session.user.name,
-      creationPolicy
-    )
+    let defaultWorkspace: Awaited<ReturnType<typeof createDefaultWorkspace>>
+    try {
+      defaultWorkspace = await createDefaultWorkspace(
+        session.user.id,
+        session.user.name,
+        creationPolicy
+      )
+    } catch (error) {
+      /**
+       * The user joined an organization between the empty list read and the
+       * default-workspace insert. Their workspaces (the join sweep's output)
+       * exist now — re-list and return that instead of failing the load.
+       */
+      if (error instanceof PersonalWorkspaceCreationRacedError) {
+        logger.info('Default workspace creation raced an organization join; re-listing', {
+          userId: session.user.id,
+        })
+        const refreshedPayload = await listWorkspacesForViewer({
+          userId: session.user.id,
+          activeOrganizationId,
+          scope,
+        })
+        return NextResponse.json(refreshedPayload)
+      }
+      throw error
+    }
 
     await migrateExistingWorkflows(session.user.id, defaultWorkspace.id)
 
@@ -118,6 +151,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       organizationId: creationPolicy.organizationId,
       workspaceMode: creationPolicy.workspaceMode,
       billedAccountUserId: creationPolicy.billedAccountUserId,
+      observedOrganizationId: creationPolicy.observedOrganizationId,
     })
 
     captureServerEvent(
@@ -156,6 +190,15 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
 
     return NextResponse.json({ workspace: newWorkspace })
   } catch (error) {
+    if (error instanceof PersonalWorkspaceCreationRacedError) {
+      return NextResponse.json(
+        {
+          error:
+            'You joined an organization while this workspace was being created. Organization members create organization workspaces — try again.',
+        },
+        { status: 409 }
+      )
+    }
     logger.error('Error creating workspace:', error)
     return NextResponse.json({ error: 'Failed to create workspace' }, { status: 500 })
   }
@@ -168,6 +211,7 @@ async function createDefaultWorkspace(
     organizationId: string | null
     workspaceMode: WorkspaceMode
     billedAccountUserId: string
+    observedOrganizationId: string | null
   }
 ) {
   const firstName = userName?.split(' ')[0] || null
@@ -178,11 +222,14 @@ async function createDefaultWorkspace(
     organizationId: creationPolicy.organizationId,
     workspaceMode: creationPolicy.workspaceMode,
     billedAccountUserId: creationPolicy.billedAccountUserId,
+    observedOrganizationId: creationPolicy.observedOrganizationId,
   })
 }
 
 interface CreateWorkspaceParams {
   userId: string
+  /** Membership the creation policy observed; see WorkspaceCreationPolicy. */
+  observedOrganizationId: string | null
   name: string
   skipDefaultWorkflow?: boolean
   explicitColor?: string
@@ -193,6 +240,7 @@ interface CreateWorkspaceParams {
 
 async function createWorkspace({
   userId,
+  observedOrganizationId,
   name,
   skipDefaultWorkflow = false,
   explicitColor,
@@ -207,6 +255,33 @@ async function createWorkspace({
 
   try {
     await db.transaction(async (tx) => {
+      /**
+       * Personal creation serializes with organization joins on the user's
+       * billing-identity lock: joins hold it while sweeping the joiner's
+       * owned workspaces, so re-checking membership under it here means a
+       * workspace can never be created personal after (or while) its owner
+       * joins an organization — the creation-policy read above this
+       * transaction can be stale by the time the insert runs.
+       */
+      if (!organizationId) {
+        await acquireUserBillingIdentityLock(tx, userId)
+        const [currentMembership] = await tx
+          .select({ organizationId: member.organizationId })
+          .from(member)
+          .where(eq(member.userId, userId))
+          .limit(1)
+        /**
+         * Only a CHANGE since the policy read means the decision is stale. An
+         * unchanged membership is legitimately personal — the policy returns
+         * a personal decision for members whose organization has no usable
+         * Team/Enterprise plan (a dormant org), and those users must still be
+         * able to create workspaces.
+         */
+        if ((currentMembership?.organizationId ?? null) !== observedOrganizationId) {
+          throw new PersonalWorkspaceCreationRacedError()
+        }
+      }
+
       await tx.insert(workspace).values({
         id: workspaceId,
         name,
diff --git a/apps/sim/app/invite/[id]/invite.test.tsx b/apps/sim/app/invite/[id]/invite.test.tsx
index 7e2c3310010..83fba300438 100644
--- a/apps/sim/app/invite/[id]/invite.test.tsx
+++ b/apps/sim/app/invite/[id]/invite.test.tsx
@@ -46,13 +46,48 @@ vi.mock('next/navigation', () => ({
   useSearchParams: () => mockSearchParams,
 }))
 
-vi.mock('@tanstack/react-query', () => ({
-  useQueryClient: () => ({
-    cancelQueries: mockCancelQueries,
-    invalidateQueries: mockInvalidateQueries,
-    setQueryData: mockSetQueryData,
-  }),
-}))
+vi.mock('@tanstack/react-query', async () => {
+  const React = await import('react')
+  return {
+    useQueryClient: () => ({
+      cancelQueries: mockCancelQueries,
+      invalidateQueries: mockInvalidateQueries,
+      setQueryData: mockSetQueryData,
+    }),
+    /**
+     * Minimal useQuery stand-in: runs the queryFn once when enabled and
+     * exposes { data, error, isPending } — enough for the invitation fetch.
+     */
+    useQuery: (options: {
+      queryFn: (context: { signal?: AbortSignal }) => Promise<unknown>
+      enabled?: boolean
+    }) => {
+      const [state, setState] = React.useState<{
+        data: unknown
+        error: unknown
+        isPending: boolean
+      }>({ data: undefined, error: null, isPending: true })
+      const enabled = options.enabled !== false
+      React.useEffect(() => {
+        if (!enabled) return
+        let cancelled = false
+        options.queryFn({}).then(
+          (data) => {
+            if (!cancelled) setState({ data, error: null, isPending: false })
+          },
+          (error) => {
+            if (!cancelled) setState({ data: undefined, error, isPending: false })
+          }
+        )
+        return () => {
+          cancelled = true
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+      }, [enabled])
+      return state
+    },
+  }
+})
 
 vi.mock('@/lib/api/client/request', () => ({
   requestJson: mockRequestJson,
@@ -246,6 +281,6 @@ describe('Invite', () => {
       cache: 'session',
       error: 'Session refresh denied',
     })
-    expect(mockLogger.warn).toHaveBeenCalledTimes(3)
+    expect(mockLogger.warn).toHaveBeenCalledTimes(4)
   })
 })
diff --git a/apps/sim/app/invite/[id]/invite.tsx b/apps/sim/app/invite/[id]/invite.tsx
index 09391178790..bf40c712f9e 100644
--- a/apps/sim/app/invite/[id]/invite.tsx
+++ b/apps/sim/app/invite/[id]/invite.tsx
@@ -2,21 +2,26 @@
 
 import { useEffect, useState } from 'react'
 import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
 import { getErrorMessage } from '@sim/utils/errors'
+import { formatQuotedNameList } from '@sim/utils/string'
 import { useQueryClient } from '@tanstack/react-query'
 import { useParams, useRouter, useSearchParams } from 'next/navigation'
 import { ApiClientError } from '@/lib/api/client/errors'
 import { requestJson } from '@/lib/api/client/request'
-import {
-  acceptInvitationContract,
-  getInvitationContract,
-  type InvitationDetails,
-} from '@/lib/api/contracts/invitations'
+import { acceptInvitationContract } from '@/lib/api/contracts/invitations'
 import { client, useSession } from '@/lib/auth/auth-client'
+import {
+  buildMembershipNotice,
+  buildWorkspaceMigrationNotice,
+  MAX_LISTED_WORKSPACE_NAMES,
+} from '@/lib/invitations/disclosure-copy'
 import { InviteLayout, InviteStatusCard } from '@/app/invite/components'
+import { useInvitationDetails } from '@/hooks/queries/invitations'
 import { organizationKeys } from '@/hooks/queries/organization'
 import { refreshSessionQuery } from '@/hooks/queries/session'
 import { subscriptionKeys } from '@/hooks/queries/subscription'
+import { workspaceKeys } from '@/hooks/queries/workspace'
 
 const logger = createLogger('InviteById')
 
@@ -38,11 +43,13 @@ type InviteErrorCode =
   | 'already-processed'
   | 'email-mismatch'
   | 'workspace-not-found'
+  | 'disclosure-outdated'
   | 'user-not-found'
   | 'already-member'
   | 'already-in-organization'
   | 'no-seats-available'
   | 'upgrade-required'
+  | 'external-requires-paid-plan'
   | 'invalid-invitation'
   | 'missing-invitation-id'
   | 'server-error'
@@ -86,6 +93,12 @@ function getInviteError(code: string): InviteError {
       code: 'workspace-not-found',
       message: 'The workspace associated with this invitation could not be found.',
     },
+    'disclosure-outdated': {
+      code: 'disclosure-outdated',
+      message:
+        'Your workspaces changed since this page loaded. Review the updated notice and accept again.',
+      canRetry: true,
+    },
     'user-not-found': {
       code: 'user-not-found',
       message: 'Your user account could not be found. Please try signing out and signing back in.',
@@ -112,6 +125,12 @@ function getInviteError(code: string): InviteError {
         'The workspace owner needs an active paid plan with billing set up before you can join. Ask them to update their plan, then try again.',
       canRetry: true,
     },
+    'external-requires-paid-plan': {
+      code: 'external-requires-paid-plan',
+      message:
+        'External collaborators need their own paid Sim plan. Upgrade your plan, or ask the organization to re-invite you as a member — that uses one of their seats instead.',
+      canRetry: true,
+    },
     'invalid-invitation': {
       code: 'invalid-invitation',
       message: 'This invitation is invalid or no longer exists.',
@@ -181,9 +200,8 @@ export default function Invite() {
   const searchParams = useSearchParams()
   const { data: session, isPending } = useSession()
   const queryClient = useQueryClient()
-  const [invitation, setInvitation] = useState<InvitationDetails | null>(null)
-  const [isLoading, setIsLoading] = useState(true)
-  const [error, setError] = useState<InviteError | null>(null)
+  const [actionError, setActionError] = useState<InviteError | null>(null)
+  const [urlError, setUrlError] = useState<InviteError | null>(null)
   const [isAccepting, setIsAccepting] = useState(false)
   const [accepted, setAccepted] = useState(false)
   const [isNewUser, setIsNewUser] = useState(false)
@@ -206,37 +224,30 @@ export default function Invite() {
     }
 
     if (errorReason) {
-      setError(getInviteError(errorReason))
-      setIsLoading(false)
+      setUrlError(getInviteError(errorReason))
     }
   }, [searchParams, inviteId, inviteTokenStorageKey])
 
-  useEffect(() => {
-    if (!session?.user) return
-
-    async function fetchInvitation() {
-      setIsLoading(true)
-      try {
-        const data = await requestJson(getInvitationContract, {
-          params: { id: inviteId },
-          query: { token: token ?? undefined },
-        })
-        setInvitation(data.invitation)
-        setError(null)
-      } catch (fetchError) {
-        logger.error('Error fetching invitation:', fetchError)
-        const code =
-          fetchError instanceof ApiClientError
-            ? codeFromApiClientError(fetchError)
-            : 'network-error'
-        setError(getInviteError(code))
-      } finally {
-        setIsLoading(false)
-      }
-    }
-
-    fetchInvitation()
-  }, [session?.user, inviteId, token])
+  const invitationQuery = useInvitationDetails(inviteId, token, session?.user?.id ?? null, {
+    enabled: Boolean(session?.user),
+  })
+  const invitation = invitationQuery.data?.invitation ?? null
+  const joinPreview = invitationQuery.data?.joinPreview ?? null
+  const joinPreviewUnavailable = invitationQuery.data?.joinPreviewUnavailable === true
+  const isLoading = Boolean(session?.user) && invitationQuery.isPending
+
+  const fetchError = invitationQuery.error
+    ? getInviteError(
+        invitationQuery.error instanceof ApiClientError
+          ? codeFromApiClientError(invitationQuery.error)
+          : 'network-error'
+      )
+    : null
+  /**
+   * Action errors (accept failures) outrank fetch errors; the URL error param
+   * only shows until the invitation loads successfully.
+   */
+  const error = actionError ?? fetchError ?? (invitationQuery.data ? null : urlError)
 
   const handleAcceptInvitation = async () => {
     if (!session?.user || !invitation) return
@@ -245,7 +256,18 @@ export default function Invite() {
     try {
       const data = await requestJson(acceptInvitationContract, {
         params: { id: inviteId },
-        body: { token: token ?? undefined },
+        body: {
+          token: token ?? undefined,
+          /**
+           * Disclosure token: acceptance rejects with disclosure-outdated if
+           * the sweep set no longer matches what this screen showed. Sent
+           * whenever a preview rendered — a no-join preview means the user
+           * was shown that nothing moves (an empty disclosed set), which
+           * must also conflict if acceptance would sweep anything.
+           */
+          disclosedWorkspaceIds: joinPreview ? joinPreview.workspaceIdsToMove : undefined,
+          disclosedOutcome: joinPreview?.outcome,
+        },
       })
 
       setAccepted(true)
@@ -259,13 +281,32 @@ export default function Invite() {
       runBestEffortCacheRefresh('organization', () =>
         queryClient.invalidateQueries({ queryKey: organizationKeys.all })
       )
+      /**
+       * Acceptance can attach the invitee's owned workspaces into the org —
+       * the workspace list must not keep serving the stale personal set.
+       */
+      runBestEffortCacheRefresh('workspaces', () =>
+        queryClient.invalidateQueries({ queryKey: workspaceKeys.all })
+      )
     } catch (acceptError) {
       logger.error('Error accepting invitation:', acceptError)
       const code =
         acceptError instanceof ApiClientError
           ? codeFromApiClientError(acceptError)
           : 'network-error'
-      setError(getInviteError(code))
+      const serverMessage =
+        acceptError instanceof ApiClientError &&
+        acceptError.body &&
+        typeof acceptError.body === 'object' &&
+        typeof (acceptError.body as { message?: unknown }).message === 'string'
+          ? ((acceptError.body as { message: string }).message as string)
+          : null
+      const baseError = getInviteError(code)
+      setActionError(
+        code === 'server-error' && serverMessage
+          ? { ...baseError, message: serverMessage }
+          : baseError
+      )
       setIsAccepting(false)
     }
   }
@@ -420,9 +461,19 @@ export default function Invite() {
     )
   }
 
+  /**
+   * Names every granted workspace, not just the primary one — an invitation can
+   * span several, and the email already lists them all.
+   */
+  const grantedWorkspaceNames =
+    invitation?.grants
+      .map((grant) => grant.workspaceName)
+      .filter((name): name is string => Boolean(name)) ?? []
   const displayName =
     invitation?.kind === 'workspace'
-      ? invitation.grants[0]?.workspaceName || 'a workspace'
+      ? grantedWorkspaceNames.length > 0
+        ? formatQuotedNameList(grantedWorkspaceNames, MAX_LISTED_WORKSPACE_NAMES)
+        : 'a workspace'
       : invitation?.organizationName || 'an organization'
 
   if (accepted) {
@@ -440,13 +491,53 @@ export default function Invite() {
   }
 
   const isOrg = invitation?.kind === 'organization'
+  /**
+   * Prefer the preview's organization (the one acceptance will really join)
+   * over the invitation's stamped name — a granted workspace may have moved
+   * organizations since the invite was sent.
+   */
+  const organizationLabel =
+    joinPreview?.organizationName || invitation?.organizationName || 'the organization'
+  /**
+   * When the server could not compute the preview, fall back to a generic
+   * migration notice for membership invites — a missing preview must never
+   * read as "nothing moves".
+   */
+  const migrationNotice = buildWorkspaceMigrationNotice({
+    joinPreview,
+    joinPreviewUnavailable,
+    membershipIntent: invitation?.membershipIntent,
+    organizationLabel,
+  })
+  /**
+   * Only disclosed when the invitation actually carries organization standing —
+   * a personal-workspace invite has no seat or membership to explain.
+   */
+  const membershipNotice = buildMembershipNotice({
+    joinPreview,
+    membershipIntent: invitation?.membershipIntent,
+    isOrganizationAdminRole: Boolean(invitation?.role && isOrgAdminRole(invitation.role)),
+    organizationLabel,
+    /**
+     * A personal-workspace invite has no organization id and no organization
+     * name yet — acceptance creates one by converting the billed owner's Pro to
+     * Team — so a `will-join` outcome is the authoritative signal that a
+     * membership and seat are involved. Gating on the ids alone silenced the
+     * disclosure for exactly the case that creates the membership.
+     */
+    isOrganizationScoped: Boolean(
+      invitation?.organizationId ||
+        joinPreview?.organizationName ||
+        joinPreview?.outcome === 'will-join'
+    ),
+  })
 
   return (
     <InviteLayout>
       <InviteStatusCard
         type='invitation'
         title={isOrg ? 'Organization Invitation' : 'Workspace Invitation'}
-        description={`You've been invited to join ${displayName}. Click accept below to join.`}
+        description={`You've been invited to join ${displayName}.${membershipNotice}${migrationNotice}`}
         icon={isOrg ? 'users' : 'mail'}
         actions={[
           {
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/index.ts b/apps/sim/app/workspace/[workspaceId]/components/invite-modal/index.ts
similarity index 100%
rename from apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/index.ts
rename to apps/sim/app/workspace/[workspaceId]/components/invite-modal/index.ts
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/invite-modal.test.tsx b/apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.test.tsx
similarity index 58%
rename from apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/invite-modal.test.tsx
rename to apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.test.tsx
index c1f8bf34dec..30dfb22fb17 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/invite-modal.test.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.test.tsx
@@ -6,49 +6,41 @@ import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { hostContext, mockUseOrganizationBilling } = vi.hoisted(() => ({
-  hostContext: {
-    current: {
-      hostOrganizationId: 'org-host',
-      viewer: { isHostOrganizationAdmin: false },
+const { hostContext, mockUseOrganizationBilling, mockUseAdminWorkspaces, mockMutate } = vi.hoisted(
+  () => ({
+    hostContext: {
+      current: {
+        hostOrganizationId: 'org-host',
+        viewer: { isHostOrganizationAdmin: false },
+      },
     },
-  },
-  mockUseOrganizationBilling: vi.fn(),
-}))
+    mockUseOrganizationBilling: vi.fn(),
+    mockUseAdminWorkspaces: vi.fn(),
+    mockMutate: vi.fn(),
+  })
+)
 
 vi.mock('@sim/emcn', () => ({
+  ChipDropdown: () => <div />,
   ChipModal: ({ children }: { children: ReactNode }) => <div>{children}</div>,
   ChipModalBody: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  ChipModalError: ({ children }: { children: ReactNode }) => <div>{children}</div>,
   ChipModalField: () => <div />,
   ChipModalFooter: () => <div />,
   ChipModalHeader: ({ children }: { children: ReactNode }) => <div>{children}</div>,
   toast: { success: vi.fn() },
 }))
 
-vi.mock('next/navigation', () => ({
-  useParams: () => ({ workspaceId: 'workspace-1' }),
-}))
-
 vi.mock('@/lib/auth/auth-client', () => ({
-  useSession: () => ({ data: { user: { email: 'viewer@example.com' } } }),
+  useSession: () => ({ data: { user: { id: 'user-1', email: 'viewer@example.com' } } }),
 }))
 
 vi.mock('@/app/workspace/[workspaceId]/providers/workspace-host-provider', () => ({
   useWorkspaceHostContext: () => hostContext.current,
 }))
 
-vi.mock('@/app/workspace/[workspaceId]/providers/workspace-permissions-provider', () => ({
-  useWorkspacePermissionsContext: () => ({
-    workspacePermissions: { users: [] },
-    userPermissions: { canAdmin: true },
-  }),
-}))
-
 vi.mock('@/hooks/queries/invitations', () => ({
-  useBatchSendWorkspaceInvitations: () => ({
-    isPending: false,
-    mutate: vi.fn(),
-  }),
+  useSendWorkspaceInvitations: () => ({ isPending: false, mutate: mockMutate }),
 }))
 
 vi.mock('@/hooks/queries/organization', () => ({
@@ -58,7 +50,14 @@ vi.mock('@/hooks/queries/organization', () => ({
   },
 }))
 
-import { InviteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/invite-modal'
+vi.mock('@/hooks/queries/workspace', () => ({
+  useAdminWorkspaces: (...args: unknown[]) => {
+    mockUseAdminWorkspaces(...args)
+    return { data: [] }
+  },
+}))
+
+import { InviteModal } from '@/app/workspace/[workspaceId]/components/invite-modal/invite-modal'
 
 let container: HTMLDivElement
 let root: Root
@@ -89,7 +88,13 @@ describe('InviteModal organization billing isolation', () => {
   it('does not fetch admin billing data for a workspace-only administrator', async () => {
     await act(async () => {
       root.render(
-        <InviteModal open onOpenChange={vi.fn()} organizationId='org-host' workspaceName='Host' />
+        <InviteModal
+          open
+          onOpenChange={vi.fn()}
+          workspaceId='workspace-1'
+          organizationId='org-host'
+          workspaceName='Host'
+        />
       )
     })
 
@@ -104,7 +109,13 @@ describe('InviteModal organization billing isolation', () => {
 
     await act(async () => {
       root.render(
-        <InviteModal open onOpenChange={vi.fn()} organizationId='org-host' workspaceName='Host' />
+        <InviteModal
+          open
+          onOpenChange={vi.fn()}
+          workspaceId='workspace-1'
+          organizationId='org-host'
+          workspaceName='Host'
+        />
       )
     })
 
@@ -119,10 +130,32 @@ describe('InviteModal organization billing isolation', () => {
 
     await act(async () => {
       root.render(
-        <InviteModal open onOpenChange={vi.fn()} organizationId='org-other' workspaceName='Host' />
+        <InviteModal
+          open
+          onOpenChange={vi.fn()}
+          workspaceId='workspace-1'
+          organizationId='org-other'
+          workspaceName='Host'
+        />
       )
     })
 
     expect(mockUseOrganizationBilling).toHaveBeenCalledWith('org-other', { enabled: false })
   })
+
+  it('does not list selectable workspaces outside an organization', async () => {
+    await act(async () => {
+      root.render(
+        <InviteModal
+          open
+          onOpenChange={vi.fn()}
+          workspaceId='workspace-1'
+          organizationId={null}
+          workspaceName='Personal'
+        />
+      )
+    })
+
+    expect(mockUseAdminWorkspaces).toHaveBeenCalledWith('user-1', undefined, { enabled: false })
+  })
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.tsx b/apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.tsx
new file mode 100644
index 00000000000..b3aa448ede2
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/components/invite-modal/invite-modal.tsx
@@ -0,0 +1,340 @@
+'use client'
+
+import { useCallback, useMemo, useState } from 'react'
+import {
+  ChipDropdown,
+  type ChipDropdownOption,
+  ChipModal,
+  ChipModalBody,
+  ChipModalError,
+  ChipModalField,
+  ChipModalFooter,
+  ChipModalHeader,
+  toast,
+} from '@sim/emcn'
+import { createLogger } from '@sim/logger'
+import { useSession } from '@/lib/auth/auth-client'
+import { isEnterprise } from '@/lib/billing/plan-helpers'
+import { isBillingEnabled } from '@/lib/core/config/env-flags'
+import { quickValidateEmail } from '@/lib/messaging/email/validation'
+import type { PermissionType } from '@/lib/workspaces/permissions/utils'
+import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
+import { useSendWorkspaceInvitations } from '@/hooks/queries/invitations'
+import { useOrganizationBilling } from '@/hooks/queries/organization'
+import { useAdminWorkspaces } from '@/hooks/queries/workspace'
+
+const logger = createLogger('InviteModal')
+
+const ACCESS_OPTIONS = [
+  { value: 'admin', label: 'Admin' },
+  { value: 'write', label: 'Write' },
+  { value: 'read', label: 'Read' },
+] as const
+
+const MEMBERSHIP_OPTIONS = [
+  { value: 'member', label: 'Member' },
+  { value: 'admin', label: 'Admin' },
+  { value: 'external', label: 'External' },
+] as const
+
+type Membership = (typeof MEMBERSHIP_OPTIONS)[number]['value']
+
+const MEMBERSHIP_HINTS: Record<Membership, string> = {
+  member: 'Joins your organization. Adds a seat.',
+  admin: 'Joins your organization and can manage it. Adds a seat.',
+  external:
+    'Access to the selected workspaces only — no seat. Only available for people already on a paid Sim plan.',
+}
+
+const EMPTY_WORKSPACE_IDS: string[] = []
+
+interface InviteModalProps {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  /**
+   * Workspace the invite starts from. Pre-selected on open, and the only
+   * option outside an organization — personal workspaces are invited to one at
+   * a time. Omit when inviting from organization settings, where no single
+   * workspace is in context.
+   */
+  workspaceId?: string
+  workspaceName?: string
+  /** Organization the invite is scoped to; null for a personal workspace. */
+  organizationId?: string | null
+  /** Set when the plan or policy blocks invites for this workspace. */
+  inviteDisabledReason?: string | null
+  /** False when the viewer lacks permission to invite. */
+  canInvite?: boolean
+}
+
+/**
+ * The single invite surface: pick people, pick the workspaces to give them,
+ * pick what they become in the organization. Every entry point renders this,
+ * so an invite means the same thing wherever it is sent from.
+ */
+export function InviteModal({
+  open,
+  onOpenChange,
+  workspaceId,
+  workspaceName,
+  organizationId = null,
+  inviteDisabledReason = null,
+  canInvite = true,
+}: InviteModalProps) {
+  const [emails, setEmails] = useState<string[]>([])
+  const [selectedWorkspaceIds, setSelectedWorkspaceIds] = useState<string[]>(
+    workspaceId ? [workspaceId] : EMPTY_WORKSPACE_IDS
+  )
+  const [access, setAccess] = useState<PermissionType>('write')
+  const [membership, setMembership] = useState<Membership>('member')
+  const [errorMessage, setErrorMessage] = useState<string | null>(null)
+
+  /**
+   * Seed a fresh invite each time the modal opens, so a re-open never inherits
+   * the previous attempt and the pre-selected workspace tracks the one the
+   * viewer is actually in.
+   */
+  const [wasOpen, setWasOpen] = useState(open)
+  if (wasOpen !== open) {
+    setWasOpen(open)
+    if (open) {
+      setEmails([])
+      setSelectedWorkspaceIds(workspaceId ? [workspaceId] : EMPTY_WORKSPACE_IDS)
+      setAccess('write')
+      setMembership('member')
+      setErrorMessage(null)
+    }
+  }
+
+  const { data: session } = useSession()
+  const isOrganizationInvite = Boolean(organizationId)
+
+  const sendInvitations = useSendWorkspaceInvitations()
+  const isSubmitting = sendInvitations.isPending
+
+  /**
+   * Only organization invites offer a choice of workspaces: a personal
+   * workspace has no siblings an invite can span.
+   */
+  const { data: adminWorkspaces } = useAdminWorkspaces(
+    session?.user?.id,
+    organizationId ?? undefined,
+    { enabled: open && isOrganizationInvite }
+  )
+
+  const workspaceOptions = useMemo<ChipDropdownOption[]>(() => {
+    if (!isOrganizationInvite) {
+      return workspaceId ? [{ value: workspaceId, label: workspaceName ?? 'This workspace' }] : []
+    }
+    return (adminWorkspaces ?? [])
+      .filter((workspace) => workspace.canInvite || workspace.id === workspaceId)
+      .map((workspace) => ({ value: workspace.id, label: workspace.name }))
+  }, [isOrganizationInvite, adminWorkspaces, workspaceId, workspaceName])
+
+  /**
+   * Seat data is organization-admin-only, and the prop can lag the route, so
+   * it is fetched solely when the viewer administers the organization the page
+   * is actually hosted by.
+   */
+  const hostContext = useWorkspaceHostContext()
+  /**
+   * Organization Admin is an organization-level grant — it carries admin on every
+   * workspace the org owns plus member and billing management — so it is only
+   * offered to someone who already holds it. The batch endpoint enforces the same
+   * rule; this only keeps the UI from presenting an option that would be refused.
+   */
+  const canGrantOrganizationAdmin =
+    isOrganizationInvite &&
+    hostContext.hostOrganizationId === organizationId &&
+    hostContext.viewer.isHostOrganizationAdmin
+  const membershipOptions = canGrantOrganizationAdmin
+    ? MEMBERSHIP_OPTIONS
+    : MEMBERSHIP_OPTIONS.filter((option) => option.value !== 'admin')
+  const canViewOrganizationBilling =
+    isOrganizationInvite &&
+    hostContext.hostOrganizationId === organizationId &&
+    hostContext.viewer.isHostOrganizationAdmin
+
+  const { data: organizationBillingData } = useOrganizationBilling(organizationId ?? '', {
+    enabled: open && isBillingEnabled && canViewOrganizationBilling,
+  })
+
+  const totalSeats = organizationBillingData?.data?.totalSeats ?? 0
+  const usedSeats = organizationBillingData?.data?.usedSeats ?? 0
+  const availableSeats = Math.max(0, totalSeats - usedSeats)
+  /**
+   * Only Enterprise plans have a fixed seat cap that gates invites. Team seats
+   * are provisioned when an invitee accepts, and externals never take one.
+   */
+  const isEnterpriseOrg = isEnterprise(organizationBillingData?.data?.subscriptionPlan)
+  const hasSeatData = canViewOrganizationBilling && isEnterpriseOrg && totalSeats > 0
+  /**
+   * Advisory only. The server decides per email and does not charge a seat for
+   * everyone: an existing organization member is granted access directly, and an
+   * invitee who already belongs to another organization is forced external. A
+   * hard block here refused batches the API would have accepted, so this warns
+   * and lets the send proceed — per-email failures come back with reasons.
+   */
+  const mayExceedSeatCapacity =
+    hasSeatData && membership !== 'external' && emails.length > availableSeats
+  const seatLimitReason = mayExceedSeatCapacity
+    ? `Only ${availableSeats} seat${availableSeats === 1 ? '' : 's'} available — invites beyond that may fail. External collaborators and existing members do not use seats.`
+    : null
+
+  const validateEmail = useCallback(
+    (email: string): string | null => {
+      const formatResult = quickValidateEmail(email)
+      if (!formatResult.isValid) {
+        return formatResult.reason ?? 'Invalid email'
+      }
+      if (session?.user?.email && session.user.email.toLowerCase() === email) {
+        return 'You cannot invite yourself'
+      }
+      return null
+    },
+    [session?.user?.email]
+  )
+
+  const handleEmailsChange = useCallback((next: string[]) => {
+    setEmails(next)
+    setErrorMessage(null)
+  }, [])
+
+  const handleSend = useCallback(() => {
+    setErrorMessage(null)
+    if (emails.length === 0 || selectedWorkspaceIds.length === 0) return
+
+    sendInvitations.mutate(
+      {
+        workspaceIds: selectedWorkspaceIds,
+        emails,
+        permission: access,
+        membership: isOrganizationInvite ? membership : undefined,
+        organizationId,
+      },
+      {
+        onSuccess: (result) => {
+          const parts: string[] = []
+          if (result.added.length > 0) {
+            parts.push(`${result.added.length} member${result.added.length === 1 ? '' : 's'} added`)
+          }
+          if (result.successful.length > 0) {
+            parts.push(
+              `${result.successful.length} invite${result.successful.length === 1 ? '' : 's'} sent`
+            )
+          }
+          if (parts.length > 0) {
+            toast.success(parts.join(' · '))
+          }
+
+          if (result.failed.length > 0) {
+            // Keep the failed addresses in the field, with the reason, for retry.
+            setEmails(result.failed.map((failure) => failure.email))
+            setErrorMessage(
+              result.failed.length === 1
+                ? result.failed[0].error
+                : `${result.failed.length} invitations failed. ${result.failed[0].error}`
+            )
+            return
+          }
+
+          setEmails([])
+          onOpenChange(false)
+        },
+        onError: (error) => {
+          logger.error('Failed to invite teammates', { error })
+          setErrorMessage(error.message || 'An unexpected error occurred. Please try again.')
+        },
+      }
+    )
+  }, [
+    emails,
+    selectedWorkspaceIds,
+    access,
+    membership,
+    isOrganizationInvite,
+    organizationId,
+    onOpenChange,
+  ])
+
+  const isSendDisabled =
+    !canInvite ||
+    Boolean(inviteDisabledReason) ||
+    isSubmitting ||
+    emails.length === 0 ||
+    selectedWorkspaceIds.length === 0
+
+  return (
+    <ChipModal
+      open={open}
+      onOpenChange={onOpenChange}
+      srTitle={`Invite teammates to ${workspaceName || 'workspace'}`}
+    >
+      <ChipModalHeader onClose={() => onOpenChange(false)}>Invite teammates</ChipModalHeader>
+      <ChipModalBody>
+        <ChipModalField
+          type='emails'
+          title='Emails'
+          value={emails}
+          onChange={handleEmailsChange}
+          validate={validateEmail}
+          hint={inviteDisabledReason ?? seatLimitReason}
+          placeholder={
+            canInvite
+              ? 'Enter emails'
+              : inviteDisabledReason || 'Only administrators can invite new teammates'
+          }
+          disabled={isSubmitting || !canInvite}
+        />
+        <ChipModalField type='custom' title='Workspaces'>
+          <ChipDropdown
+            multiple
+            value={selectedWorkspaceIds}
+            onChange={setSelectedWorkspaceIds}
+            options={workspaceOptions}
+            allLabel='Select workspaces'
+            showAllOption={false}
+            searchable={isOrganizationInvite}
+            searchPlaceholder='Search workspaces...'
+            fullWidth
+            flush
+            disabled={isSubmitting || !canInvite || workspaceOptions.length <= 1}
+          />
+        </ChipModalField>
+        <ChipModalField
+          type='dropdown'
+          title='Workspace access'
+          options={ACCESS_OPTIONS}
+          value={access}
+          placeholder='Select access'
+          align='start'
+          disabled={isSubmitting || !canInvite}
+          onChange={(next) => setAccess(next as PermissionType)}
+        />
+        {isOrganizationInvite && (
+          <ChipModalField
+            type='dropdown'
+            title='Membership'
+            options={membershipOptions}
+            value={membership}
+            placeholder='Select membership'
+            align='start'
+            hint={MEMBERSHIP_HINTS[membership]}
+            disabled={isSubmitting || !canInvite}
+            onChange={(next) => setMembership(next as Membership)}
+          />
+        )}
+        <ChipModalError>{errorMessage}</ChipModalError>
+      </ChipModalBody>
+      <ChipModalFooter
+        onCancel={() => onOpenChange(false)}
+        cancelDisabled={isSubmitting}
+        primaryAction={{
+          label: isSubmitting ? 'Sending...' : 'Send invites',
+          onClick: handleSend,
+          disabled: isSendDisabled,
+        }}
+      />
+    </ChipModal>
+  )
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/index.ts b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/index.ts
index 6a4f3bae67e..fc31aad7ec5 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/index.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/index.ts
@@ -1,6 +1,5 @@
 export { ManageCreditsModal } from './manage-credits-modal'
 export { NoOrganizationView } from './no-organization-view'
-export { OrganizationInviteModal } from './organization-invite-modal'
 export { OrganizationMemberLists } from './organization-member-lists'
 export { RemoveMemberDialog } from './remove-member-dialog'
 export { TeamSeatsOverview } from './team-seats-overview'
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/organization-invite-modal/index.ts b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/organization-invite-modal/index.ts
deleted file mode 100644
index 3f58645d1dc..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/organization-invite-modal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { OrganizationInviteModal } from './organization-invite-modal'
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/organization-invite-modal/organization-invite-modal.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/organization-invite-modal/organization-invite-modal.tsx
deleted file mode 100644
index 70c9a201f9d..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/organization-invite-modal/organization-invite-modal.tsx
+++ /dev/null
@@ -1,242 +0,0 @@
-'use client'
-
-import { useCallback, useMemo, useState } from 'react'
-import {
-  ChipDropdown,
-  type ChipDropdownOption,
-  ChipModal,
-  ChipModalBody,
-  ChipModalField,
-  ChipModalFooter,
-  ChipModalHeader,
-  toast,
-} from '@sim/emcn'
-import { createLogger } from '@sim/logger'
-import { useSession } from '@/lib/auth/auth-client'
-import { quickValidateEmail } from '@/lib/messaging/email/validation'
-import type { PermissionType } from '@/lib/workspaces/permissions/utils'
-import { useInviteMember } from '@/hooks/queries/organization'
-
-const logger = createLogger('OrganizationInviteModal')
-
-const ROLE_OPTIONS = [
-  { value: 'admin', label: 'Admin' },
-  { value: 'write', label: 'Write' },
-  { value: 'read', label: 'Read' },
-] as const
-
-const EMPTY_EMAILS: string[] = []
-
-interface OrganizationInviteModalProps {
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  organizationId: string
-  /** Workspaces the inviter can grant access to. */
-  workspaces: Array<{ id: string; name: string }>
-  /** Emails of external collaborators (rejected — they cannot join the organization). */
-  externalEmails?: string[]
-  /**
-   * Non-member emails with a pending invitation (rejected as duplicates).
-   * Member emails are always allowed — they receive workspace invitations for
-   * the selected workspaces they aren't in yet, deduped per workspace by the
-   * server — so the parent excludes them from this list.
-   */
-  pendingEmails?: string[]
-}
-
-/**
- * Organization-level invite modal: enter emails, pick one or more workspaces to
- * grant access to, choose a role applied to every selected workspace, and send
- * through the organization invite path. Emails of existing organization
- * members are accepted — the server sends them workspace-only invitations for
- * the selected workspaces they don't already have access to.
- */
-export function OrganizationInviteModal({
-  open,
-  onOpenChange,
-  organizationId,
-  workspaces,
-  externalEmails = EMPTY_EMAILS,
-  pendingEmails = EMPTY_EMAILS,
-}: OrganizationInviteModalProps) {
-  const [emails, setEmails] = useState<string[]>([])
-  const [selectedWorkspaceIds, setSelectedWorkspaceIds] = useState<string[]>([])
-  const [inviteRole, setInviteRole] = useState<PermissionType>('write')
-  const [errorMessage, setErrorMessage] = useState<string | null>(null)
-
-  const { data: session } = useSession()
-  const inviteMember = useInviteMember()
-  const isSubmitting = inviteMember.isPending
-
-  const workspaceOptions = useMemo<ChipDropdownOption[]>(
-    () => workspaces.map((workspace) => ({ value: workspace.id, label: workspace.name })),
-    [workspaces]
-  )
-
-  const externalEmailSet = useMemo(
-    () => new Set(externalEmails.map((email) => email.toLowerCase())),
-    [externalEmails]
-  )
-
-  const pendingEmailSet = useMemo(
-    () => new Set(pendingEmails.map((email) => email.toLowerCase())),
-    [pendingEmails]
-  )
-
-  const validateEmail = useCallback(
-    (email: string): string | null => {
-      const formatResult = quickValidateEmail(email)
-      if (!formatResult.isValid) {
-        return formatResult.reason ?? 'Invalid email'
-      }
-      if (session?.user?.email && session.user.email.toLowerCase() === email) {
-        return 'You cannot invite yourself'
-      }
-      if (externalEmailSet.has(email)) {
-        return `${email} belongs to another organization and can't be invited. Invite them to individual workspaces from the Teammates tab.`
-      }
-      if (pendingEmailSet.has(email)) {
-        return `${email} already has a pending invitation`
-      }
-      return null
-    },
-    [session?.user?.email, externalEmailSet, pendingEmailSet]
-  )
-
-  const handleEmailsChange = useCallback((next: string[]) => {
-    setEmails(next)
-    setErrorMessage(null)
-  }, [])
-
-  const handleSend = useCallback(() => {
-    setErrorMessage(null)
-    if (emails.length === 0 || selectedWorkspaceIds.length === 0 || !organizationId) return
-
-    const workspaceInvitations = selectedWorkspaceIds.map((workspaceId) => ({
-      workspaceId,
-      permission: inviteRole as 'admin' | 'write' | 'read',
-    }))
-
-    inviteMember.mutate(
-      { emails, orgId: organizationId, workspaceInvitations },
-      {
-        onSuccess: (result) => {
-          const summary =
-            'data' in result && result.data && typeof result.data === 'object'
-              ? (result.data as {
-                  invitationsSent?: number
-                  directlyAddedCount?: number
-                  failedInvitations?: Array<{ email: string; error: string }>
-                })
-              : null
-          const addedCount = summary?.directlyAddedCount ?? 0
-          const sentCount = summary?.invitationsSent ?? 0
-          const failed = summary?.failedInvitations ?? []
-
-          // Surface partial successes even when some addresses fail.
-          const parts: string[] = []
-          if (addedCount > 0) {
-            parts.push(`${addedCount} member${addedCount === 1 ? '' : 's'} added`)
-          }
-          if (sentCount > 0) {
-            parts.push(`${sentCount} invite${sentCount === 1 ? '' : 's'} sent`)
-          }
-          if (parts.length > 0) {
-            toast.success(parts.join(' · '))
-          }
-
-          if (failed.length > 0) {
-            // Keep only the failed addresses (workspaces stay selected) for retry.
-            setEmails(failed.map((entry) => entry.email))
-            setErrorMessage(
-              failed.length === 1
-                ? failed[0].error
-                : `${failed.length} invitations failed. ${failed[0].error}`
-            )
-            return
-          }
-
-          setEmails([])
-          setSelectedWorkspaceIds([])
-          onOpenChange(false)
-        },
-        onError: (error) => {
-          logger.error('Failed to invite members', { error })
-          setErrorMessage(error.message || 'An unexpected error occurred. Please try again.')
-        },
-      }
-    )
-  }, [emails, selectedWorkspaceIds, organizationId, inviteRole, inviteMember.mutate, onOpenChange])
-
-  const resetState = useCallback(() => {
-    setEmails([])
-    setSelectedWorkspaceIds([])
-    setInviteRole('write')
-    setErrorMessage(null)
-  }, [])
-
-  const handleOpenChange = useCallback(
-    (next: boolean) => {
-      if (!next) resetState()
-      onOpenChange(next)
-    },
-    [onOpenChange, resetState]
-  )
-
-  const isSendDisabled =
-    isSubmitting || emails.length === 0 || selectedWorkspaceIds.length === 0 || !organizationId
-
-  return (
-    <ChipModal
-      open={open}
-      onOpenChange={handleOpenChange}
-      srTitle='Invite teammates to organization'
-    >
-      <ChipModalHeader onClose={() => handleOpenChange(false)}>Invite teammates</ChipModalHeader>
-      <ChipModalBody>
-        <ChipModalField
-          type='emails'
-          title='Emails'
-          value={emails}
-          onChange={handleEmailsChange}
-          validate={validateEmail}
-          error={errorMessage}
-          placeholder='Enter emails'
-          disabled={isSubmitting}
-        />
-        <ChipModalField type='custom' title='Workspaces'>
-          <ChipDropdown
-            multiple
-            value={selectedWorkspaceIds}
-            onChange={setSelectedWorkspaceIds}
-            options={workspaceOptions}
-            allLabel='Select workspaces'
-            showAllOption={false}
-            searchable
-            searchPlaceholder='Search workspaces...'
-            fullWidth
-            flush
-            disabled={isSubmitting || workspaceOptions.length === 0}
-          />
-        </ChipModalField>
-        <ChipModalField
-          type='dropdown'
-          title='Invite as'
-          options={ROLE_OPTIONS}
-          value={inviteRole}
-          placeholder='Select role'
-          align='start'
-          onChange={(role) => setInviteRole(role as PermissionType)}
-        />
-      </ChipModalBody>
-      <ChipModalFooter
-        onCancel={() => handleOpenChange(false)}
-        primaryAction={{
-          label: isSubmitting ? 'Sending...' : 'Send invites',
-          onClick: handleSend,
-          disabled: isSendDisabled,
-        }}
-      />
-    </ChipModal>
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/remove-member-dialog/remove-member-dialog.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/remove-member-dialog/remove-member-dialog.tsx
index b1de51ae765..e526f782360 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/remove-member-dialog/remove-member-dialog.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/components/remove-member-dialog/remove-member-dialog.tsx
@@ -1,11 +1,25 @@
 import { ChipConfirmModal } from '@sim/emcn'
 import { getErrorMessage } from '@sim/utils/errors'
+import { formatQuotedNameList } from '@sim/utils/string'
+
+const MAX_LISTED_CREDENTIALS = 3
 
 interface RemoveMemberDialogProps {
   open: boolean
   memberName: string
   isSelfRemoval?: boolean
   isExternalRemoval?: boolean
+  /**
+   * Display names of identity-bound credentials (OAuth accounts, personal env
+   * keys) the member owns in organization workspaces. These stop working on
+   * removal and must be reconnected by a remaining member — disclosed here,
+   * never blocking.
+   */
+  breakingCredentials?: string[]
+  /** The impact check is still loading — confirm is held until it resolves. */
+  credentialImpactPending?: boolean
+  /** The impact check failed — removal stays possible, with a caution shown. */
+  credentialImpactFailed?: boolean
   isSubmitting?: boolean
   error?: Error | null
   onOpenChange: (open: boolean) => void
@@ -22,6 +36,9 @@ export function RemoveMemberDialog({
   onCancel,
   isSelfRemoval = false,
   isExternalRemoval = false,
+  breakingCredentials = [],
+  credentialImpactPending = false,
+  credentialImpactFailed = false,
   isSubmitting = false,
 }: RemoveMemberDialogProps) {
   const title = isSelfRemoval
@@ -32,6 +49,16 @@ export function RemoveMemberDialog({
 
   const errorMessage = error ? getErrorMessage(error) || 'Failed to remove member' : null
 
+  const credentialWarning = credentialImpactFailed
+    ? `Couldn't check which credentials ${isSelfRemoval ? 'you own' : 'they own'} will be affected — connected accounts backed by ${isSelfRemoval ? 'your' : 'their'} identity may stop working after removal.`
+    : breakingCredentials.length > 0
+      ? `${breakingCredentials.length === 1 ? 'A credential' : `${breakingCredentials.length} credentials`} ${
+          isSelfRemoval ? 'you own' : 'they own'
+        } (${formatQuotedNameList(breakingCredentials, MAX_LISTED_CREDENTIALS)}) will stop working in organization workspaces until another member reconnects ${
+          breakingCredentials.length === 1 ? 'it' : 'them'
+        }.`
+      : null
+
   return (
     <ChipConfirmModal
       open={open}
@@ -60,8 +87,22 @@ export function RemoveMemberDialog({
         label: isSelfRemoval ? 'Leave Organization' : 'Remove',
         onClick: () => onConfirmRemove(),
         pending: isSubmitting,
+        /**
+         * `disabled`, not `pending`: the impact check is a precondition, and
+         * `pending` means "the confirm is in flight" — the primitive also
+         * disables the dismiss button while pending, which must stay available
+         * while we are merely loading the disclosure.
+         */
+        disabled: credentialImpactPending,
       }}
     >
+      {credentialImpactPending ? (
+        <p className='mt-1 px-2 text-[var(--text-muted)] text-caption'>
+          Checking which connected credentials this affects…
+        </p>
+      ) : credentialWarning ? (
+        <p className='mt-1 px-2 text-[var(--text-muted)] text-caption'>{credentialWarning}</p>
+      ) : null}
       {errorMessage ? (
         <p role='alert' className='mt-1 px-2 text-[var(--text-error)] text-caption'>
           {errorMessage}
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
index 3a80877faab..53883488cdf 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
@@ -1,16 +1,16 @@
 'use client'
 
-import { useCallback, useEffect, useMemo, useState } from 'react'
+import { useCallback, useEffect, useState } from 'react'
 import { Plus } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import { useSession } from '@/lib/auth/auth-client'
 import { getSubscriptionAccessState } from '@/lib/billing/client/utils'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { generateSlug, isAdminOrOwner, type Member } from '@/lib/workspaces/organization'
+import { InviteModal } from '@/app/workspace/[workspaceId]/components/invite-modal'
 import { SettingsPanel } from '@/app/workspace/[workspaceId]/settings/components/settings-panel'
 import {
   NoOrganizationView,
-  OrganizationInviteModal,
   OrganizationMemberLists,
   RemoveMemberDialog,
   TeamSeatsOverview,
@@ -19,6 +19,7 @@ import {
 import { useSettingsSearch } from '@/app/workspace/[workspaceId]/settings/components/use-settings-search'
 import {
   useCreateOrganization,
+  useMemberRemovalImpact,
   useOrganization,
   useOrganizationBilling,
   useOrganizationRoster,
@@ -77,6 +78,23 @@ export function TeamManagement({
   const [orgName, setOrgName] = useState('')
   const [orgSlug, setOrgSlug] = useState('')
 
+  /**
+   * `isFetching` (not `isLoading`) gates the confirm button: a background
+   * refetch of cached data must also hold removal so the admin never
+   * confirms against a stale credential-impact list.
+   */
+  const {
+    data: removalImpactCredentials,
+    isFetching: isRemovalImpactFetching,
+    isError: isRemovalImpactError,
+  } = useMemberRemovalImpact(organizationId, removeMemberDialog.memberId, {
+    enabled: removeMemberDialog.open,
+  })
+
+  const disclosedBreakingCredentials = [
+    ...new Set(removalImpactCredentials?.map((credential) => credential.displayName) ?? []),
+  ]
+
   const totalSeats = organizationBillingData?.data?.totalSeats ?? 0
   const usedSeats = organizationBillingData?.data?.members?.length ?? 0
   const reservedSeats = organizationBillingData?.data?.usedSeats ?? 0
@@ -99,32 +117,6 @@ export function TeamManagement({
       }
     : null
 
-  const externalEmails = useMemo(() => {
-    const emails: string[] = []
-    for (const member of roster?.members ?? []) {
-      if (member.role === 'external') emails.push(member.email)
-    }
-    return emails
-  }, [roster])
-
-  /**
-   * Pending invitations for emails that already belong to a member are
-   * excluded: members can always be re-invited to additional workspaces (the
-   * server dedupes per workspace), so only non-member pending emails are
-   * blocked in the invite modal.
-   */
-  const pendingEmails = useMemo(() => {
-    const memberEmailSet = new Set<string>()
-    for (const member of roster?.members ?? []) {
-      if (member.role !== 'external') memberEmailSet.add(member.email.toLowerCase())
-    }
-    const emails: string[] = []
-    for (const invitation of roster?.pendingInvitations ?? []) {
-      if (!memberEmailSet.has(invitation.email.toLowerCase())) emails.push(invitation.email)
-    }
-    return emails
-  }, [roster])
-
   useEffect(() => {
     if ((hasTeamPlan || hasEnterprisePlan) && session?.user?.name && !orgName) {
       const defaultName = `${session.user.name}'s Team`
@@ -353,13 +345,11 @@ export function TeamManagement({
       </SettingsPanel>
 
       {adminOrOwner && (
-        <OrganizationInviteModal
+        <InviteModal
           open={inviteModalOpen}
           onOpenChange={setInviteModalOpen}
           organizationId={displayOrganization.id}
-          workspaces={roster?.workspaces ?? []}
-          externalEmails={externalEmails}
-          pendingEmails={pendingEmails}
+          canInvite={adminOrOwner}
         />
       )}
 
@@ -383,6 +373,9 @@ export function TeamManagement({
         memberName={removeMemberDialog.memberName}
         isSelfRemoval={removeMemberDialog.isSelfRemoval}
         isExternalRemoval={removeMemberDialog.isExternalRemoval}
+        breakingCredentials={disclosedBreakingCredentials}
+        credentialImpactPending={isRemovalImpactFetching}
+        credentialImpactFailed={isRemovalImpactError}
         isSubmitting={removeMemberMutation.isPending}
         error={removeMemberMutation.error}
         onOpenChange={(open: boolean) => {
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/teammates/teammates.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/teammates/teammates.tsx
index 170c5c9ec2d..b9b8763bc0f 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/teammates/teammates.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/teammates/teammates.tsx
@@ -15,6 +15,7 @@ import { canMutateWorkspaceSettingsSection } from '@/components/settings/navigat
 import type { WorkspacePermission } from '@/lib/api/contracts/workspaces'
 import { buildUpgradeHref } from '@/lib/billing/upgrade-reasons'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
+import { InviteModal } from '@/app/workspace/[workspaceId]/components/invite-modal'
 import {
   MemberRow,
   MemberSection,
@@ -22,7 +23,6 @@ import {
 import { RowActionsMenu } from '@/app/workspace/[workspaceId]/settings/components/row-actions-menu'
 import { SettingsPanel } from '@/app/workspace/[workspaceId]/settings/components/settings-panel'
 import { useSettingsSearch } from '@/app/workspace/[workspaceId]/settings/components/use-settings-search'
-import { InviteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal'
 import {
   useCancelWorkspaceInvitation,
   usePendingInvitations,
@@ -58,6 +58,15 @@ interface Teammate {
   roleSource?: WorkspaceRoleSource
 }
 
+/**
+ * Marks collaborators who hold this workspace without belonging to its
+ * organization. Shown on the status line rather than the role chip, which
+ * carries the workspace permission — a separate axis from membership.
+ */
+function withExternalLabel(status: string, isExternal: boolean | undefined): string {
+  return isExternal ? `${status} \u00b7 External` : status
+}
+
 function copyToClipboard(text: string) {
   void navigator.clipboard.writeText(text)
 }
@@ -124,7 +133,10 @@ export function Teammates() {
       name: member.name ?? member.email,
       image: member.image,
       role: member.permissionType,
-      status: `Joined ${formatDate(new Date(member.joinedAt))}`,
+      status: withExternalLabel(
+        `Joined ${formatDate(new Date(member.joinedAt))}`,
+        member.isExternal
+      ),
       isPending: false,
       userId: member.userId,
       roleSource: member.roleSource,
@@ -136,7 +148,7 @@ export function Teammates() {
       name: invitation.email,
       image: null,
       role: invitation.permissionType,
-      status: 'Invite pending',
+      status: withExternalLabel('Invite pending', invitation.isExternal),
       isPending: true,
       invitationId: invitation.invitationId,
       token: invitation.token,
@@ -304,9 +316,11 @@ export function Teammates() {
         <InviteModal
           open={isInviteModalOpen}
           onOpenChange={setIsInviteModalOpen}
+          workspaceId={workspaceId}
           workspaceName={activeWorkspace?.name ?? 'Workspace'}
           inviteDisabledReason={inviteDisabledReason}
           organizationId={activeWorkspace?.organizationId ?? null}
+          canInvite={canManage}
         />
       )}
     </>
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/invite-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/invite-modal.tsx
deleted file mode 100644
index 22923d5cfb7..00000000000
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal/invite-modal.tsx
+++ /dev/null
@@ -1,221 +0,0 @@
-'use client'
-
-import { useCallback, useState } from 'react'
-import {
-  ChipModal,
-  ChipModalBody,
-  ChipModalField,
-  ChipModalFooter,
-  ChipModalHeader,
-  toast,
-} from '@sim/emcn'
-import { createLogger } from '@sim/logger'
-import { useParams } from 'next/navigation'
-import { useSession } from '@/lib/auth/auth-client'
-import { isEnterprise } from '@/lib/billing/plan-helpers'
-import { isBillingEnabled } from '@/lib/core/config/env-flags'
-import { quickValidateEmail } from '@/lib/messaging/email/validation'
-import type { PermissionType } from '@/lib/workspaces/permissions/utils'
-import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
-import { useWorkspacePermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
-import { useBatchSendWorkspaceInvitations } from '@/hooks/queries/invitations'
-import { useOrganizationBilling } from '@/hooks/queries/organization'
-
-const logger = createLogger('InviteModal')
-
-const ROLE_OPTIONS = [
-  { value: 'admin', label: 'Admin' },
-  { value: 'write', label: 'Write' },
-  { value: 'read', label: 'Read' },
-] as const
-
-interface InviteModalProps {
-  open: boolean
-  onOpenChange: (open: boolean) => void
-  workspaceName?: string
-  inviteDisabledReason?: string | null
-  organizationId?: string | null
-}
-
-export function InviteModal({
-  open,
-  onOpenChange,
-  workspaceName,
-  inviteDisabledReason = null,
-  organizationId = null,
-}: InviteModalProps) {
-  const [emails, setEmails] = useState<string[]>([])
-  const [inviteRole, setInviteRole] = useState<PermissionType>('admin')
-  const [errorMessage, setErrorMessage] = useState<string | null>(null)
-
-  const params = useParams()
-  const workspaceId = params.workspaceId as string
-
-  const { data: session } = useSession()
-  const hostContext = useWorkspaceHostContext()
-  const { workspacePermissions, userPermissions: userPerms } = useWorkspacePermissionsContext()
-  const canViewOrganizationBilling =
-    Boolean(organizationId) &&
-    hostContext.hostOrganizationId === organizationId &&
-    hostContext.viewer.isHostOrganizationAdmin
-
-  const { data: organizationBillingData } = useOrganizationBilling(organizationId ?? '', {
-    enabled: open && isBillingEnabled && canViewOrganizationBilling,
-  })
-
-  const batchSendInvitations = useBatchSendWorkspaceInvitations()
-
-  const canInviteMembers = userPerms.canAdmin && !inviteDisabledReason
-  const isSubmitting = batchSendInvitations.isPending
-
-  const totalSeats = organizationBillingData?.data?.totalSeats ?? 0
-  const usedSeats = organizationBillingData?.data?.usedSeats ?? 0
-  const availableSeats = Math.max(0, totalSeats - usedSeats)
-  // Only Enterprise plans have a fixed seat cap that gates invites. Team/Pro
-  // seats are provisioned automatically when an invitee accepts.
-  const isEnterpriseOrg = isEnterprise(organizationBillingData?.data?.subscriptionPlan)
-  const hasSeatData = canViewOrganizationBilling && isEnterpriseOrg && totalSeats > 0
-  const exceedsSeatCapacity = hasSeatData && userPerms.canAdmin && emails.length > availableSeats
-  const seatLimitReason = exceedsSeatCapacity
-    ? `Only ${availableSeats} internal seat${availableSeats === 1 ? '' : 's'} available. External workspace invites do not require seats.`
-    : null
-
-  const validateEmail = useCallback(
-    (email: string): string | null => {
-      const formatResult = quickValidateEmail(email)
-      if (!formatResult.isValid) {
-        return formatResult.reason ?? 'Invalid email'
-      }
-      if (workspacePermissions?.users?.some((user) => user.email === email)) {
-        return `${email} is already a teammate in this workspace`
-      }
-      if (session?.user?.email && session.user.email.toLowerCase() === email) {
-        return 'You cannot invite yourself'
-      }
-      return null
-    },
-    [workspacePermissions?.users, session?.user?.email]
-  )
-
-  const handleEmailsChange = useCallback((next: string[]) => {
-    setEmails(next)
-    setErrorMessage(null)
-  }, [])
-
-  const handleSendInvites = useCallback(() => {
-    setErrorMessage(null)
-    if (!canInviteMembers || emails.length === 0 || !workspaceId) return
-
-    const invitations = emails.map((email) => ({ email, permission: inviteRole }))
-
-    batchSendInvitations.mutate(
-      { workspaceId, organizationId, invitations },
-      {
-        onSuccess: (result) => {
-          const parts: string[] = []
-          if (result.added.length > 0) {
-            parts.push(`${result.added.length} member${result.added.length === 1 ? '' : 's'} added`)
-          }
-          if (result.successful.length > 0) {
-            parts.push(
-              `${result.successful.length} invite${result.successful.length === 1 ? '' : 's'} sent`
-            )
-          }
-          if (parts.length > 0) {
-            toast.success(parts.join(' · '))
-          }
-
-          if (result.failed.length > 0) {
-            // Keep the failed addresses in the field with the error for retry.
-            setEmails(result.failed.map((f) => f.email))
-            setErrorMessage(
-              result.failed.length === 1
-                ? result.failed[0].error
-                : `${result.failed.length} invitations failed. ${result.failed[0].error}`
-            )
-            return
-          }
-
-          setEmails([])
-          onOpenChange(false)
-        },
-        onError: (error) => {
-          logger.error('Error inviting teammates:', error)
-          setErrorMessage(error.message || 'An unexpected error occurred. Please try again.')
-        },
-      }
-    )
-  }, [
-    canInviteMembers,
-    emails,
-    workspaceId,
-    organizationId,
-    inviteRole,
-    batchSendInvitations,
-    onOpenChange,
-  ])
-
-  const resetState = useCallback(() => {
-    setEmails([])
-    setInviteRole('admin')
-    setErrorMessage(null)
-  }, [])
-
-  const handleOpenChange = useCallback(
-    (next: boolean) => {
-      if (!next) resetState()
-      onOpenChange(next)
-    },
-    [onOpenChange, resetState]
-  )
-
-  const isSendDisabled =
-    !canInviteMembers || isSubmitting || !workspaceId || emails.length === 0 || exceedsSeatCapacity
-
-  const fieldHint = inviteDisabledReason ?? seatLimitReason
-
-  return (
-    <ChipModal
-      open={open}
-      onOpenChange={handleOpenChange}
-      srTitle={`Invite teammates to ${workspaceName || 'workspace'}`}
-    >
-      <ChipModalHeader onClose={() => handleOpenChange(false)}>Invite teammates</ChipModalHeader>
-      <ChipModalBody>
-        <ChipModalField
-          type='emails'
-          title='Emails'
-          value={emails}
-          onChange={handleEmailsChange}
-          validate={validateEmail}
-          error={errorMessage}
-          hint={fieldHint}
-          placeholder={
-            !canInviteMembers
-              ? inviteDisabledReason || 'Only administrators can invite new teammates'
-              : 'Enter emails'
-          }
-          disabled={isSubmitting || !canInviteMembers}
-        />
-        <ChipModalField
-          type='dropdown'
-          title='Invite as'
-          options={ROLE_OPTIONS}
-          value={inviteRole}
-          placeholder='Select role'
-          align='start'
-          onChange={(role) => setInviteRole(role as PermissionType)}
-        />
-      </ChipModalBody>
-      <ChipModalFooter
-        onCancel={() => handleOpenChange(false)}
-        cancelDisabled={isSubmitting}
-        primaryAction={{
-          label: isSubmitting ? 'Sending...' : 'Send invites',
-          onClick: handleSendInvites,
-          disabled: isSendDisabled,
-        }}
-      />
-    </ChipModal>
-  )
-}
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx
index 53a6056ece5..bcbbf3da591 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal.tsx
@@ -2,9 +2,14 @@
 
 import { Chip, ChipModal, ChipModalBody, ChipModalFooter, ChipModalHeader, toast } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useRouter } from 'next/navigation'
-import type { InvitationDetails } from '@/lib/api/contracts/invitations'
+import type { MyInvitation } from '@/lib/api/contracts/invitations'
+import {
+  buildMembershipNotice,
+  buildWorkspaceMigrationNotice,
+} from '@/lib/invitations/disclosure-copy'
 import { getInvitationErrorMessage } from '@/lib/invitations/error-messages'
 import {
   useAcceptMyInvitation,
@@ -19,7 +24,7 @@ const logger = createLogger('ViewInvitationsModal')
  * invites are labeled by the org (even when workspace grants ride along);
  * workspace invites by their workspace(s).
  */
-function invitationLabel(inv: InvitationDetails): string {
+function invitationLabel(inv: MyInvitation): string {
   if (inv.kind === 'organization') {
     return inv.organizationName ?? 'Organization'
   }
@@ -32,12 +37,43 @@ function invitationLabel(inv: InvitationDetails): string {
 }
 
 /** Secondary line: who invited, plus role (org) or permission (workspace). */
-function invitationSubLabel(inv: InvitationDetails): string {
+function invitationSubLabel(inv: MyInvitation): string {
   const invitedBy = inv.inviterName ? `Invited by ${inv.inviterName}` : 'Invited'
   const detail = inv.kind === 'organization' ? inv.role : inv.grants[0]?.permission
   return detail ? `${invitedBy} · ${detail}` : invitedBy
 }
 
+/**
+ * What accepting will do to the invitee's own account: the seat/membership
+ * consequence and any workspaces that will move into the organization. Built
+ * from the same copy as the emailed `/invite` page so the two accept surfaces
+ * can never disclose different outcomes.
+ */
+function invitationDisclosure(inv: MyInvitation): string {
+  const organizationLabel =
+    inv.joinPreview?.organizationName ?? inv.organizationName ?? 'the organization'
+  const membership = buildMembershipNotice({
+    joinPreview: inv.joinPreview,
+    membershipIntent: inv.membershipIntent,
+    isOrganizationAdminRole: isOrgAdminRole(inv.role),
+    organizationLabel,
+    /** A `will-join` outcome also covers a personal-workspace invite, which has
+     * no organization id or name until acceptance creates one. */
+    isOrganizationScoped: Boolean(
+      inv.organizationId ||
+        inv.joinPreview?.organizationName ||
+        inv.joinPreview?.outcome === 'will-join'
+    ),
+  })
+  const migration = buildWorkspaceMigrationNotice({
+    joinPreview: inv.joinPreview,
+    joinPreviewUnavailable: inv.joinPreview === null,
+    membershipIntent: inv.membershipIntent,
+    organizationLabel,
+  })
+  return `${membership}${migration}`.trim()
+}
+
 interface ViewInvitationsModalProps {
   open: boolean
   onOpenChange: (open: boolean) => void
@@ -58,9 +94,13 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
 
   const isBusy = acceptInvitation.isPending || declineInvitation.isPending
 
-  const handleAccept = async (inv: InvitationDetails) => {
+  const handleAccept = async (inv: MyInvitation) => {
     try {
-      const result = await acceptInvitation.mutateAsync({ invitationId: inv.id })
+      const result = await acceptInvitation.mutateAsync({
+        invitationId: inv.id,
+        disclosedWorkspaceIds: inv.joinPreview?.workspaceIdsToMove,
+        disclosedOutcome: inv.joinPreview?.outcome,
+      })
       toast.success(`Joined ${invitationLabel(inv)}`)
       onOpenChange(false)
       router.push(result.redirectPath)
@@ -75,7 +115,7 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
     }
   }
 
-  const handleDecline = async (inv: InvitationDetails) => {
+  const handleDecline = async (inv: MyInvitation) => {
     try {
       await declineInvitation.mutateAsync({ invitationId: inv.id })
     } catch (error) {
@@ -93,32 +133,38 @@ export function ViewInvitationsModal({ open, onOpenChange }: ViewInvitationsModa
         {!invitations || invitations.length === 0 ? (
           <p className='px-2 text-[var(--text-muted)] text-sm'>No pending invitations.</p>
         ) : (
-          invitations.map((inv) => (
-            <div key={inv.id} className='flex items-center gap-2 px-2'>
-              <div className='min-w-0 flex-1'>
-                <p className='truncate text-[var(--text-body)] text-sm'>{invitationLabel(inv)}</p>
-                <p className='truncate text-[var(--text-muted)] text-caption'>
-                  {invitationSubLabel(inv)}
-                </p>
+          invitations.map((inv) => {
+            const disclosure = invitationDisclosure(inv)
+            return (
+              <div key={inv.id} className='flex items-start gap-2 px-2'>
+                <div className='min-w-0 flex-1'>
+                  <p className='truncate text-[var(--text-body)] text-sm'>{invitationLabel(inv)}</p>
+                  <p className='truncate text-[var(--text-muted)] text-caption'>
+                    {invitationSubLabel(inv)}
+                  </p>
+                  {disclosure ? (
+                    <p className='mt-1 text-[var(--text-muted)] text-caption'>{disclosure}</p>
+                  ) : null}
+                </div>
+                <Chip
+                  variant='primary'
+                  disabled={isBusy}
+                  onClick={() => void handleAccept(inv)}
+                  className='flex-shrink-0'
+                >
+                  Accept
+                </Chip>
+                <Chip
+                  disabled={isBusy}
+                  onClick={() => void handleDecline(inv)}
+                  aria-label={`Decline invitation to ${invitationLabel(inv)}`}
+                  className='flex-shrink-0'
+                >
+                  Decline
+                </Chip>
               </div>
-              <Chip
-                variant='primary'
-                disabled={isBusy}
-                onClick={() => void handleAccept(inv)}
-                className='flex-shrink-0'
-              >
-                Accept
-              </Chip>
-              <Chip
-                disabled={isBusy}
-                onClick={() => void handleDecline(inv)}
-                aria-label={`Decline invitation to ${invitationLabel(inv)}`}
-                className='flex-shrink-0'
-              >
-                Decline
-              </Chip>
-            </div>
-          ))
+            )
+          })
         )}
       </ChipModalBody>
       <ChipModalFooter
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx
index 574953a523f..8a14799949d 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/workspace-header.tsx
@@ -24,13 +24,14 @@ import { useQueryClient } from '@tanstack/react-query'
 import { MoreHorizontal, Search } from 'lucide-react'
 import { useActiveOrganization } from '@/lib/auth/auth-client'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
+import { InviteModal } from '@/app/workspace/[workspaceId]/components/invite-modal'
+import { useWorkspacePermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import { ContextMenu } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/context-menu/context-menu'
 import { DeleteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workflow-list/components/delete-modal/delete-modal'
 import {
   CreateWorkspaceModal,
   type CreateWorkspaceTarget,
 } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/create-workspace-modal/create-workspace-modal'
-import { InviteModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/invite-modal'
 import { ViewInvitationsMenuItem } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-menu-item'
 import { ViewInvitationsModal } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/workspace-header/components/pending-invitations/view-invitations-modal'
 import { invitationKeys } from '@/hooks/queries/invitations'
@@ -244,6 +245,13 @@ function WorkspaceHeaderImpl({
   const createWorkspaceDisabledReason =
     workspaceCreationPolicy?.canCreate === false ? workspaceCreationPolicy.reason : null
   const { isInvitationsDisabled: isInvitationsDisabledByConfig } = usePermissionConfig()
+  /**
+   * Only workspace admins can invite. The modal takes this as a prop, so each
+   * entry point supplies it — the pre-consolidation modal derived it internally,
+   * and omitting it here left the form fully enabled for non-admins until the
+   * server refused the send.
+   */
+  const { userPermissions } = useWorkspacePermissionsContext()
   const inviteDisabledReason = activeWorkspaceFull?.inviteDisabledReason ?? null
   const isInvitationsDisabled = isInvitationsDisabledByConfig || inviteDisabledReason !== null
   const createWorkspaceTarget: CreateWorkspaceTarget =
@@ -867,9 +875,11 @@ function WorkspaceHeaderImpl({
       <InviteModal
         open={isInviteModalOpen}
         onOpenChange={setIsInviteModalOpen}
+        workspaceId={workspaceId}
         workspaceName={activeWorkspace?.name || 'Workspace'}
         inviteDisabledReason={inviteDisabledReason}
         organizationId={activeWorkspaceFull?.organizationId ?? null}
+        canInvite={userPermissions.canAdmin}
       />
       <ViewInvitationsModal open={isViewInvitationsOpen} onOpenChange={setIsViewInvitationsOpen} />
       <DeleteModal
diff --git a/apps/sim/app/workspace/page.tsx b/apps/sim/app/workspace/page.tsx
index 6137b205d19..8e88c906b97 100644
--- a/apps/sim/app/workspace/page.tsx
+++ b/apps/sim/app/workspace/page.tsx
@@ -12,10 +12,13 @@ import { createWorkspaceContract } from '@/lib/api/contracts/workspaces'
 import { useSession } from '@/lib/auth/auth-client'
 import { recoverFromStaleSession } from '@/lib/auth/stale-session-recovery'
 import { WorkspaceRecencyStorage } from '@/lib/core/utils/browser-storage'
-import { useWorkspacesWithMetadata, type WorkspaceCreationPolicy } from '@/hooks/queries/workspace'
+import { useWorkspacesWithMetadata } from '@/hooks/queries/workspace'
 
 const logger = createLogger('WorkspacePage')
 
+/** Bounds the one-shot reload after a creation-vs-membership 409. */
+const WORKSPACE_RACE_RETRY_KEY = 'workspaceRaceRetry'
+
 /**
  * A 401 while the session claims we're authenticated means the auth cookies
  * are stale or inconsistent (e.g. after an impersonation session expired or
@@ -27,12 +30,47 @@ function isStaleSessionError(error: unknown): boolean {
   return isApiClientError(error) && error.status === 401
 }
 
+interface WorkspaceStatusCardProps {
+  title: string
+  description: string
+  primaryLabel: string
+  onPrimary: () => void
+}
+
+function WorkspaceStatusCard({
+  title,
+  description,
+  primaryLabel,
+  onPrimary,
+}: WorkspaceStatusCardProps) {
+  return (
+    <main className='flex h-screen w-full items-center justify-center bg-[var(--surface-1)] p-6'>
+      <div className='flex max-w-md flex-col items-center gap-3 text-center'>
+        <div className='flex size-10 items-center justify-center rounded-full bg-[var(--surface-3)]'>
+          <CircleAlert className='size-[18px] text-[var(--text-icon)]' aria-hidden />
+        </div>
+        <div className='space-y-1'>
+          <h1 className='font-medium text-[var(--text-primary)] text-lg'>{title}</h1>
+          <p className='text-[var(--text-muted)] text-sm'>{description}</p>
+        </div>
+        <div className='flex items-center gap-2'>
+          <Chip variant='primary' onClick={onPrimary}>
+            {primaryLabel}
+          </Chip>
+          <Chip onClick={() => void recoverFromStaleSession()}>Sign out</Chip>
+        </div>
+      </div>
+    </main>
+  )
+}
+
 export default function WorkspacePage() {
   const router = useRouter()
   const { data: session, isPending: isSessionPending, error: sessionError } = useSession()
   const isAuthenticated = !isSessionPending && !!session?.user
   const hasRedirectedRef = useRef(false)
   const isRecoveringRef = useRef(false)
+  const blockedLoggedRef = useRef(false)
   const [recoveryFailed, setRecoveryFailed] = useState(false)
 
   const {
@@ -75,18 +113,35 @@ export default function WorkspacePage() {
 
     if (isWorkspacesLoading || workspacesError || !data) return
 
-    hasRedirectedRef.current = true
-
-    const urlParams = new URLSearchParams(window.location.search)
-    const redirectWorkflowId = urlParams.get('redirect_workflow')
-
     const { workspaces, lastActiveWorkspaceId, creationPolicy } = data
 
     if (workspaces.length === 0) {
-      handleNoWorkspaces(router, creationPolicy)
+      /**
+       * Blocked state is derived in render and deliberately does NOT set
+       * hasRedirectedRef: a later refetch that shows granted access resumes
+       * the normal redirect path, so the screen self-heals.
+       */
+      if (creationPolicy && !creationPolicy.canCreate) {
+        if (!blockedLoggedRef.current) {
+          blockedLoggedRef.current = true
+          logger.warn('No workspaces found and workspace creation is blocked', {
+            reason: creationPolicy.reason,
+            workspaceMode: creationPolicy.workspaceMode,
+            organizationId: creationPolicy.organizationId,
+          })
+        }
+        return
+      }
+      hasRedirectedRef.current = true
+      handleNoWorkspaces(router, () => setRecoveryFailed(true))
       return
     }
 
+    hasRedirectedRef.current = true
+
+    const urlParams = new URLSearchParams(window.location.search)
+    const redirectWorkflowId = urlParams.get('redirect_workflow')
+
     const localRecentId = WorkspaceRecencyStorage.getMostRecent()
     const findWorkspace = (id: string | null) =>
       id ? workspaces.find((w) => w.id === id) : undefined
@@ -103,6 +158,32 @@ export default function WorkspacePage() {
     router.replace(`/workspace/${targetWorkspace.id}/home`)
   }, [session, isSessionPending, sessionError, isWorkspacesLoading, workspacesError, data, router])
 
+  const blockedPolicy =
+    isAuthenticated &&
+    data &&
+    data.workspaces.length === 0 &&
+    data.creationPolicy &&
+    !data.creationPolicy.canCreate
+      ? data.creationPolicy
+      : null
+
+  if (blockedPolicy) {
+    return (
+      <WorkspaceStatusCard
+        title='No workspace access yet'
+        description={
+          blockedPolicy.blockedReasonCode === 'organization-subscription-inactive'
+            ? "Your organization's subscription is inactive, so new workspaces can't be created. Ask an organization owner to reactivate it."
+            : blockedPolicy.workspaceMode === 'organization'
+              ? "Your account is linked to an organization, but you don't have access to any of its workspaces. Ask an organization admin for workspace access, then check again — or sign out and back in if you recently left the organization."
+              : 'Your plan has reached its workspace limit and none of your workspaces are active. Upgrade your plan to create another workspace, or contact support to restore an archived one.'
+        }
+        primaryLabel='Check again'
+        onPrimary={() => window.location.reload()}
+      />
+    )
+  }
+
   const failedToLoad =
     recoveryFailed ||
     (Boolean(sessionError) && !session?.user) ||
@@ -110,28 +191,12 @@ export default function WorkspacePage() {
 
   if (failedToLoad) {
     return (
-      <main className='flex h-screen w-full items-center justify-center bg-[var(--surface-1)] p-6'>
-        <div className='flex max-w-md flex-col items-center gap-3 text-center'>
-          <div className='flex size-10 items-center justify-center rounded-full bg-[var(--surface-3)]'>
-            <CircleAlert className='size-[18px] text-[var(--text-icon)]' aria-hidden />
-          </div>
-          <div className='space-y-1'>
-            <h1 className='font-medium text-[var(--text-primary)] text-lg'>
-              Could not load your workspaces
-            </h1>
-            <p className='text-[var(--text-muted)] text-sm'>
-              Something went wrong while loading your account. Try again, or sign out and log back
-              in.
-            </p>
-          </div>
-          <div className='flex items-center gap-2'>
-            <Chip variant='primary' onClick={() => window.location.reload()}>
-              Try again
-            </Chip>
-            <Chip onClick={() => void recoverFromStaleSession()}>Sign out</Chip>
-          </div>
-        </div>
-      </main>
+      <WorkspaceStatusCard
+        title='Could not load your workspaces'
+        description='Something went wrong while loading your account. Try again, or sign out and log back in.'
+        primaryLabel='Try again'
+        onPrimary={() => window.location.reload()}
+      />
     )
   }
 
@@ -174,18 +239,8 @@ async function handleWorkflowRedirect(
 
 async function handleNoWorkspaces(
   router: ReturnType<typeof useRouter>,
-  creationPolicy: WorkspaceCreationPolicy | null
+  onUnrecoverable: () => void
 ): Promise<void> {
-  if (creationPolicy && !creationPolicy.canCreate) {
-    logger.warn('No workspaces found and workspace creation is blocked', {
-      reason: creationPolicy.reason,
-      workspaceMode: creationPolicy.workspaceMode,
-      organizationId: creationPolicy.organizationId,
-    })
-    router.replace('/')
-    return
-  }
-
   logger.warn('No workspaces found, creating default workspace')
   try {
     const data = await requestJson(createWorkspaceContract, {
@@ -193,11 +248,31 @@ async function handleNoWorkspaces(
     })
     if (data.workspace?.id) {
       logger.info(`Created default workspace: ${data.workspace.id}`)
+      sessionStorage.removeItem(WORKSPACE_RACE_RETRY_KEY)
       router.replace(`/workspace/${data.workspace.id}/home`)
       return
     }
     logger.error('Failed to create default workspace')
   } catch (error) {
+    /**
+     * 409 means the caller's organization membership changed while the
+     * default workspace was being created — they are still authenticated and
+     * their workspaces likely exist now, so re-resolve ONCE. A second 409
+     * means something other than a race, so surface the error card instead of
+     * reloading forever.
+     */
+    if (isApiClientError(error) && error.status === 409) {
+      if (sessionStorage.getItem(WORKSPACE_RACE_RETRY_KEY)) {
+        logger.error('Default workspace creation kept conflicting after a retry')
+        sessionStorage.removeItem(WORKSPACE_RACE_RETRY_KEY)
+        onUnrecoverable()
+        return
+      }
+      sessionStorage.setItem(WORKSPACE_RACE_RETRY_KEY, '1')
+      logger.info('Default workspace creation raced an organization change; re-resolving')
+      window.location.reload()
+      return
+    }
     logger.error('Error creating default workspace:', error)
   }
   router.replace('/login')
diff --git a/apps/sim/hooks/queries/invitations.ts b/apps/sim/hooks/queries/invitations.ts
index 472e82a6444..c4e06d67aaf 100644
--- a/apps/sim/hooks/queries/invitations.ts
+++ b/apps/sim/hooks/queries/invitations.ts
@@ -6,9 +6,11 @@ import {
   type BatchInvitationResult as BatchInvitationResultContract,
   batchWorkspaceInvitationsContract,
   cancelInvitationContract,
-  type InvitationDetails,
+  getInvitationContract,
+  type InvitationJoinOutcome,
   listMyInvitationsContract,
   listWorkspaceInvitationsContract,
+  type MyInvitation,
   type PendingInvitationRow,
   rejectInvitationContract,
   removeWorkspaceMemberContract,
@@ -25,10 +27,53 @@ export const invitationKeys = {
   all: ['invitations'] as const,
   lists: () => [...invitationKeys.all, 'list'] as const,
   list: (workspaceId: string) => [...invitationKeys.lists(), workspaceId] as const,
+  details: () => [...invitationKeys.all, 'detail'] as const,
+  /**
+   * Scoped by viewer: the response is viewer-dependent (the join preview is
+   * invitee-only, and authorization differs per account), so a cached entry
+   * must never be reused across a sign-out/sign-in on the same invite link —
+   * doing so would let a stale "nothing moves" preview become the disclosure
+   * basis for a different user.
+   */
+  detail: (invitationId: string, token: string | null, viewerId: string | null) =>
+    [...invitationKeys.details(), invitationId, token ?? '', viewerId ?? ''] as const,
   mine: () => [...invitationKeys.all, 'mine'] as const,
 }
 
 export const WORKSPACE_INVITATION_LIST_STALE_TIME = 30 * 1000
+export const INVITATION_DETAILS_STALE_TIME = 30 * 1000
+
+async function fetchInvitationDetails(
+  invitationId: string,
+  token: string | null,
+  signal?: AbortSignal
+) {
+  return requestJson(getInvitationContract, {
+    params: { id: invitationId },
+    query: { token: token ?? undefined },
+    signal,
+  })
+}
+
+/**
+ * Fetches an invitation (with the invitee-only join preview) for the accept
+ * screen. `retry: false` preserves one-shot semantics — 403/404/expired
+ * responses drive UX states and must surface immediately, not after backoff.
+ */
+export function useInvitationDetails(
+  invitationId: string | undefined,
+  token: string | null,
+  viewerId: string | null,
+  options?: { enabled?: boolean }
+) {
+  return useQuery({
+    queryKey: invitationKeys.detail(invitationId ?? '', token, viewerId),
+    queryFn: ({ signal }) => fetchInvitationDetails(invitationId as string, token, signal),
+    enabled: Boolean(invitationId) && (options?.enabled ?? true),
+    staleTime: INVITATION_DETAILS_STALE_TIME,
+    retry: false,
+  })
+}
 
 export interface WorkspaceInvitation {
   email: string
@@ -77,7 +122,7 @@ export function usePendingInvitations(workspaceId: string | undefined) {
 
 export const MY_INVITATIONS_STALE_TIME = 30 * 1000
 
-async function fetchMyPendingInvitations(signal?: AbortSignal): Promise<InvitationDetails[]> {
+async function fetchMyPendingInvitations(signal?: AbortSignal): Promise<MyInvitation[]> {
   const data = await requestJson(listMyInvitationsContract, { signal })
   return data.invitations
 }
@@ -113,8 +158,25 @@ export function useAcceptMyInvitation() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ invitationId }: { invitationId: string }) =>
-      requestJson(acceptInvitationContract, { params: { id: invitationId }, body: {} }),
+    /**
+     * `disclosedWorkspaceIds` echoes the migration the caller actually showed the
+     * invitee, so acceptance rejects if the sweep set changed since. Omitting it
+     * would silently skip that guard — the in-app path must supply it for the
+     * same reason the emailed `/invite` page does.
+     */
+    mutationFn: async ({
+      invitationId,
+      disclosedWorkspaceIds,
+      disclosedOutcome,
+    }: {
+      invitationId: string
+      disclosedWorkspaceIds?: string[]
+      disclosedOutcome?: InvitationJoinOutcome
+    }) =>
+      requestJson(acceptInvitationContract, {
+        params: { id: invitationId },
+        body: { disclosedWorkspaceIds, disclosedOutcome },
+      }),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: workspaceKeys.lists() })
       queryClient.invalidateQueries({ queryKey: organizationKeys.all })
@@ -144,51 +206,44 @@ export function useDeclineMyInvitation() {
   })
 }
 
-type BatchSendInvitationsParams = ContractBodyInput<typeof batchWorkspaceInvitationsContract> & {
+type SendInvitationsParams = ContractBodyInput<typeof batchWorkspaceInvitationsContract> & {
   organizationId?: string | null
 }
 
-type BatchInvitationResult = Pick<BatchInvitationResultContract, 'successful' | 'failed'> & {
-  added: string[]
-}
+type SendInvitationsResult = Pick<BatchInvitationResultContract, 'successful' | 'added' | 'failed'>
 
 /**
- * Sends workspace invitations through the server-side batch endpoint.
- * Returns results for each invitation indicating success or failure. Existing
- * organization members are added directly (no acceptance) and reported in
- * `added`; everyone else receives a pending invitation in `successful`.
+ * Sends invitations for one or more workspaces. Existing organization members
+ * are added directly (no acceptance) and reported in `added`; everyone else
+ * receives a single pending invitation covering every selected workspace and
+ * is reported in `successful`.
  */
-export function useBatchSendWorkspaceInvitations() {
+export function useSendWorkspaceInvitations() {
   const queryClient = useQueryClient()
 
   return useMutation({
     mutationFn: async ({
-      workspaceId,
-      invitations,
-    }: BatchSendInvitationsParams): Promise<BatchInvitationResult> => {
+      workspaceIds,
+      emails,
+      permission,
+      membership,
+    }: SendInvitationsParams): Promise<SendInvitationsResult> => {
       const result = await requestJson(batchWorkspaceInvitationsContract, {
-        body: {
-          workspaceId,
-          invitations,
-        },
+        body: { workspaceIds, emails, permission, membership },
       })
 
       return {
-        successful: result.successful ?? [],
-        added: result.added ?? [],
-        failed: result.failed ?? [],
+        successful: result.successful,
+        added: result.added,
+        failed: result.failed,
       }
     },
     onSettled: (_data, _error, variables) => {
-      queryClient.invalidateQueries({
-        queryKey: invitationKeys.list(variables.workspaceId),
-      })
-      queryClient.invalidateQueries({
-        queryKey: workspaceKeys.permissions(variables.workspaceId),
-      })
-      queryClient.invalidateQueries({
-        queryKey: workspaceKeys.members(variables.workspaceId),
-      })
+      for (const workspaceId of variables.workspaceIds) {
+        queryClient.invalidateQueries({ queryKey: invitationKeys.list(workspaceId) })
+        queryClient.invalidateQueries({ queryKey: workspaceKeys.permissions(workspaceId) })
+        queryClient.invalidateQueries({ queryKey: workspaceKeys.members(workspaceId) })
+      }
       if (variables.organizationId) {
         queryClient.invalidateQueries({
           queryKey: organizationKeys.roster(variables.organizationId),
@@ -196,6 +251,9 @@ export function useBatchSendWorkspaceInvitations() {
         queryClient.invalidateQueries({
           queryKey: organizationKeys.billing(variables.organizationId),
         })
+        queryClient.invalidateQueries({
+          queryKey: organizationKeys.detail(variables.organizationId),
+        })
       }
     },
   })
@@ -208,16 +266,21 @@ interface CancelInvitationParams {
 }
 
 /**
- * Cancels a pending workspace invitation.
- * Invalidates the invitation list cache on success.
+ * Withdraws one workspace's grant from a pending invitation.
+ *
+ * Scoped to `workspaceId` because an invitation can span several workspaces and
+ * a workspace's member list only has authority over its own access. The
+ * invitation is cancelled outright only when this was its last grant — see
+ * `useCancelInvitation` in `organization.ts` for revoking an entire invitation.
  */
 export function useCancelWorkspaceInvitation() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ invitationId }: CancelInvitationParams) => {
+    mutationFn: async ({ invitationId, workspaceId }: CancelInvitationParams) => {
       return requestJson(cancelInvitationContract, {
         params: { id: invitationId },
+        query: { workspaceId },
       })
     },
     onSettled: (_data, _error, variables) => {
diff --git a/apps/sim/hooks/queries/organization.ts b/apps/sim/hooks/queries/organization.ts
index 601ee9aed49..0845c99f71d 100644
--- a/apps/sim/hooks/queries/organization.ts
+++ b/apps/sim/hooks/queries/organization.ts
@@ -16,13 +16,14 @@ import {
 } from '@/lib/api/contracts/invitations'
 import {
   createOrganizationContract,
+  getMemberRemovalImpactContract,
   getOrganizationMemberUsageLimitContract,
   getOrganizationRosterContract,
-  inviteOrganizationMembersContract,
   listOrganizationMembersContract,
   type OrganizationMembersResponse,
   type OrganizationMemberUsageLimitData,
   type OrganizationRoster,
+  type RemovalImpactCredential,
   type RosterMember,
   type RosterPendingInvitation,
   type RosterWorkspaceAccess,
@@ -54,6 +55,12 @@ export const ORGANIZATION_SUBSCRIPTION_STALE_TIME = 30 * 1000
 export const ORGANIZATION_BILLING_STALE_TIME = 30 * 1000
 export const ORGANIZATION_MEMBERS_STALE_TIME = 30 * 1000
 export const ORGANIZATION_MEMBER_USAGE_LIMIT_STALE_TIME = 30 * 1000
+/**
+ * Zero: removal impact is a consent disclosure, so every dialog open must
+ * refetch — a cached list may omit credentials added moments ago, and the
+ * dialog holds its confirm on `isFetching` until fresh data lands.
+ */
+export const ORGANIZATION_REMOVAL_IMPACT_STALE_TIME = 0
 
 type OrganizationSubscriptionCandidate = {
   id: string
@@ -115,6 +122,8 @@ export const organizationKeys = {
   memberUsageLimit: (id: string, userId: string) =>
     [...organizationKeys.detail(id), 'member-usage-limit', userId] as const,
   roster: (id: string) => [...organizationKeys.detail(id), 'roster'] as const,
+  removalImpact: (id: string, userId: string) =>
+    [...organizationKeys.detail(id), 'removal-impact', userId] as const,
 }
 
 export type { OrganizationRoster, RosterMember, RosterPendingInvitation, RosterWorkspaceAccess }
@@ -148,6 +157,37 @@ export function useOrganizationRoster(orgId: string | undefined | null) {
   })
 }
 
+async function fetchMemberRemovalImpact(
+  orgId: string,
+  userId: string,
+  signal?: AbortSignal
+): Promise<RemovalImpactCredential[]> {
+  const data = await requestJson(getMemberRemovalImpactContract, {
+    params: { id: orgId },
+    query: { userId },
+    signal,
+  })
+  return data.credentials
+}
+
+/**
+ * Identity-bound credentials the target user owns in organization workspaces —
+ * the set that stops working after removal. Fetched lazily while the
+ * remove-member dialog is open.
+ */
+export function useMemberRemovalImpact(
+  orgId: string | undefined | null,
+  userId: string | undefined | null,
+  options?: { enabled?: boolean }
+) {
+  return useQuery({
+    queryKey: organizationKeys.removalImpact(orgId ?? '', userId ?? ''),
+    queryFn: ({ signal }) => fetchMemberRemovalImpact(orgId as string, userId as string, signal),
+    enabled: Boolean(orgId) && Boolean(userId) && (options?.enabled ?? true),
+    staleTime: ORGANIZATION_REMOVAL_IMPACT_STALE_TIME,
+  })
+}
+
 /**
  * Fetches the current viewer's account-scoped organizations.
  *
@@ -414,56 +454,6 @@ export function useUpdateOrganizationUsageLimit() {
   })
 }
 
-/**
- * Invite member mutation
- */
-type InviteMemberParams = Pick<
-  ContractBodyInput<typeof inviteOrganizationMembersContract>,
-  'emails' | 'workspaceInvitations'
-> & {
-  orgId: string
-}
-
-export function useInviteMember() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async ({ emails, workspaceInvitations, orgId }: InviteMemberParams) => {
-      /**
-       * Partial batches return HTTP 207 with `success: false` and a `data`
-       * payload (some invited/added, some failed). `requestJson` only throws on
-       * >= 400 (e.g. the total-failure 502 / validation 400 paths), so partials
-       * resolve here and the caller reports successes + per-email failures from
-       * `data` instead of surfacing a single generic error.
-       */
-      return requestJson(inviteOrganizationMembersContract, {
-        params: { id: orgId },
-        query: { batch: true },
-        body: {
-          emails,
-          workspaceInvitations,
-        },
-      })
-    },
-    onSettled: (_data, _error, variables) => {
-      queryClient.invalidateQueries({ queryKey: organizationKeys.detail(variables.orgId) })
-      queryClient.invalidateQueries({ queryKey: organizationKeys.billing(variables.orgId) })
-      queryClient.invalidateQueries({ queryKey: organizationKeys.memberUsage(variables.orgId) })
-      queryClient.invalidateQueries({ queryKey: organizationKeys.roster(variables.orgId) })
-      queryClient.invalidateQueries({ queryKey: organizationKeys.lists() })
-      // Existing members may have been added directly to selected workspaces.
-      for (const grant of variables.workspaceInvitations ?? []) {
-        queryClient.invalidateQueries({
-          queryKey: workspaceKeys.permissions(grant.workspaceId),
-        })
-        queryClient.invalidateQueries({
-          queryKey: workspaceKeys.members(grant.workspaceId),
-        })
-      }
-    },
-  })
-}
-
 /**
  * Remove member mutation
  */
@@ -618,7 +608,11 @@ export function useUpdateInvitation() {
 }
 
 /**
- * Cancel invitation mutation
+ * Revokes an entire pending invitation, including every workspace it grants.
+ *
+ * Sends no workspace scope, so the route requires authority over all of it —
+ * organization admin, or admin of every granted workspace. To withdraw a single
+ * workspace's access instead, use `useCancelWorkspaceInvitation`.
  */
 interface CancelInvitationParams {
   invitationId: string
@@ -632,6 +626,7 @@ export function useCancelInvitation() {
     mutationFn: async ({ invitationId }: CancelInvitationParams) => {
       return requestJson(cancelInvitationContract, {
         params: { id: invitationId },
+        query: {},
       })
     },
     onSettled: (_data, _error, variables) => {
diff --git a/apps/sim/hooks/queries/workspace.ts b/apps/sim/hooks/queries/workspace.ts
index 8dd00c49ebe..57f6d5166a8 100644
--- a/apps/sim/hooks/queries/workspace.ts
+++ b/apps/sim/hooks/queries/workspace.ts
@@ -343,14 +343,20 @@ async function fetchAdminWorkspaces(
 }
 
 /**
- * Fetches workspaces where the user has admin access.
+ * Fetches workspaces where the user has admin access, optionally narrowed to
+ * one organization's shared workspaces.
  * @param userId - The user ID to check admin access for
+ * @param organizationId - Restrict to this organization's workspaces
  */
-export function useAdminWorkspaces(userId: string | undefined, organizationId?: string) {
+export function useAdminWorkspaces(
+  userId: string | undefined,
+  organizationId?: string,
+  options?: { enabled?: boolean }
+) {
   return useQuery({
     queryKey: [...workspaceKeys.adminList(userId), organizationId ?? ''] as const,
     queryFn: ({ signal }) => fetchAdminWorkspaces(userId, organizationId, signal),
-    enabled: Boolean(userId),
+    enabled: Boolean(userId) && (options?.enabled ?? true),
     staleTime: WORKSPACE_ADMIN_LIST_STALE_TIME,
     placeholderData: keepPreviousData,
   })
diff --git a/apps/sim/lib/admin/dashboard.ts b/apps/sim/lib/admin/dashboard.ts
index d39f6b8405b..bbb983d567e 100644
--- a/apps/sim/lib/admin/dashboard.ts
+++ b/apps/sim/lib/admin/dashboard.ts
@@ -937,15 +937,9 @@ export async function getDashboardMemberTransferPreflight(
       .where(eq(user.id, userId))
       .limit(1),
     db
-      .select({ id: workspace.id, name: workspace.name })
+      .select({ id: workspace.id, name: workspace.name, archivedAt: workspace.archivedAt })
       .from(workspace)
-      .where(
-        and(
-          eq(workspace.ownerId, userId),
-          isNull(workspace.archivedAt),
-          ne(workspace.workspaceMode, 'organization')
-        )
-      )
+      .where(and(eq(workspace.ownerId, userId), ne(workspace.workspaceMode, 'organization')))
       .orderBy(workspace.name, workspace.id),
   ])
   if (!destination) throw new Error('Destination organization not found')
@@ -969,7 +963,11 @@ export async function getDashboardMemberTransferPreflight(
       target.organizationId && target.organizationName
         ? { id: target.organizationId, name: target.organizationName, role: target.role }
         : null,
-    personalWorkspaces,
+    personalWorkspaces: personalWorkspaces.map((row) => ({
+      id: row.id,
+      name: row.name,
+      archived: row.archivedAt !== null,
+    })),
     credentialDependencies,
     canAdd: reason === null,
     reason,
@@ -995,7 +993,6 @@ export async function addDashboardOrganizationMember(
         and(
           inArray(workspace.id, selectedWorkspaceIds),
           eq(workspace.ownerId, values.userId),
-          isNull(workspace.archivedAt),
           ne(workspace.workspaceMode, 'organization')
         )
       )
diff --git a/apps/sim/lib/api/contracts/invitations.ts b/apps/sim/lib/api/contracts/invitations.ts
index d280fb0b5e3..77b85c084b2 100644
--- a/apps/sim/lib/api/contracts/invitations.ts
+++ b/apps/sim/lib/api/contracts/invitations.ts
@@ -1,7 +1,19 @@
 import { z } from 'zod'
+import { workspaceIdSchema } from '@/lib/api/contracts/primitives'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { workspacePermissionSchema } from '@/lib/api/contracts/workspaces'
 
+/**
+ * Shared cap for the disclosure token: the preview's id list and the accept
+ * body's echo of it must agree, or a large owned-workspace set would produce a
+ * preview the accept endpoint rejects as over-long.
+ */
+export const DISCLOSED_WORKSPACE_ID_LIMIT = 500
+
+/** One invitation authorizes and stamps each workspace, so the fan-out is bounded. */
+export const MAX_INVITE_WORKSPACES = 50
+export const MAX_INVITE_EMAILS = 100
+
 export const invitationParamsSchema = z.object({
   id: z.string({ error: 'Invitation ID is required' }).min(1, 'Invitation ID is required'),
 })
@@ -37,27 +49,46 @@ export const pendingWorkspaceInvitationSchema = z
   })
   .passthrough()
 
+/**
+ * What the invitee becomes in the workspaces' organization. `member` and
+ * `admin` are organization roles that consume a seat; `external` grants the
+ * workspaces only and is restricted to invitees already on a paid plan.
+ */
+export const invitationMembershipSchema = z.enum(['member', 'admin', 'external'])
+
 export const batchWorkspaceInvitationBodySchema = z.object({
-  workspaceId: z.string().min(1, 'Workspace ID is required'),
-  invitations: z
-    .array(
-      z.object({
-        email: z.string().trim().min(1, 'Invitation email is required'),
-        permission: workspacePermissionSchema.optional(),
-      })
-    )
-    .min(1, 'At least one invitation is required'),
-})
-
-export const batchInvitationResultSchema = z
-  .object({
-    success: z.boolean(),
-    successful: z.array(z.string()),
-    added: z.array(z.string()).optional(),
-    failed: z.array(z.object({ email: z.string(), error: z.string() })),
-    invitations: z.array(z.record(z.string(), z.unknown())),
-  })
-  .passthrough()
+  workspaceIds: z
+    .array(workspaceIdSchema)
+    .min(1, 'Select at least one workspace')
+    .max(MAX_INVITE_WORKSPACES, `Select at most ${MAX_INVITE_WORKSPACES} workspaces`),
+  emails: z
+    .array(z.string().trim().min(1, 'Invitation email is required'))
+    .min(1, 'At least one invitation is required')
+    .max(MAX_INVITE_EMAILS, `Invite at most ${MAX_INVITE_EMAILS} people at a time`),
+  /** Workspace access level applied to every selected workspace. */
+  permission: workspacePermissionSchema.optional(),
+  membership: invitationMembershipSchema.optional(),
+})
+
+export const batchInvitationResultSchema = z.object({
+  success: z.boolean(),
+  /** Emails that received a pending invitation. */
+  successful: z.array(z.string()),
+  /** Emails that were existing organization members and got access immediately. */
+  added: z.array(z.string()),
+  failed: z.array(z.object({ email: z.string(), error: z.string() })),
+  invitations: z.array(
+    z.object({
+      id: z.string(),
+      email: z.string(),
+      workspaceIds: z.array(z.string()),
+      permission: workspacePermissionSchema,
+      membershipIntent: z.enum(['internal', 'external']),
+      instantAdd: z.boolean().optional(),
+      outcome: z.enum(['added', 'unchanged']).optional(),
+    })
+  ),
+})
 
 export const removeWorkspaceMemberBodySchema = z.object({
   workspaceId: z.string().uuid(),
@@ -67,8 +98,39 @@ export const invitationActionParamsSchema = z.object({
   id: z.string({ error: 'Invitation ID is required' }).min(1, 'Invitation ID is required'),
 })
 
+/**
+ * What accepting an invitation will actually do. Four outcomes rather than a
+ * boolean, because each needs different disclosure: `will-join` takes a seat,
+ * `already-member` changes nothing but workspace access, `external` never takes
+ * a seat, and `blocked` means acceptance fails so nothing is promised.
+ */
+export const invitationJoinOutcomeSchema = z.enum([
+  'will-join',
+  'already-member',
+  'external',
+  'blocked',
+])
+
+export type InvitationJoinOutcome = z.output<typeof invitationJoinOutcomeSchema>
+
 export const invitationActionBodySchema = z.object({
   token: z.string().min(1).optional(),
+  /**
+   * The workspace ids the accept screen disclosed as moving (from the join
+   * preview). When present, acceptance fails with `disclosure-outdated` if
+   * the set it would actually sweep differs — consent is only valid for the
+   * set the user saw.
+   */
+  disclosedWorkspaceIds: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT).optional(),
+  /**
+   * The outcome the accept screen disclosed. The workspace-id list alone cannot
+   * express it — a no-join preview and a will-join preview for someone who owns
+   * nothing both disclose `[]` — so consent to becoming a seat-consuming member
+   * is carried explicitly. Sending `blocked` tells acceptance the screen already
+   * said this would fail, so it should surface the real cause rather than a
+   * consent mismatch.
+   */
+  disclosedOutcome: invitationJoinOutcomeSchema.optional(),
 })
 
 export const invitationDetailsSchema = z.object({
@@ -93,6 +155,21 @@ export const invitationDetailsSchema = z.object({
   ),
 })
 
+export const invitationJoinPreviewSchema = z.object({
+  outcome: invitationJoinOutcomeSchema,
+  /** Name of the organization acceptance will actually join. */
+  organizationName: z.string().nullable(),
+  workspacesToMove: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT),
+  /**
+   * Stable ids behind `workspacesToMove`, echoed back on accept as the
+   * disclosure token: acceptance rejects when the set it would sweep no
+   * longer matches what this preview disclosed. Capped at the same limit as
+   * the accept body's echo so a large owned set can never render an invite
+   * permanently un-acceptable.
+   */
+  workspaceIdsToMove: z.array(z.string()).max(DISCLOSED_WORKSPACE_ID_LIMIT),
+})
+
 export const acceptInvitationResponseSchema = z.object({
   success: z.literal(true),
   redirectPath: z.string(),
@@ -151,17 +228,40 @@ export const getInvitationContract = defineRouteContract({
     mode: 'json',
     schema: z.object({
       invitation: invitationDetailsSchema,
+      /** Invitee-only preview of what accepting will do; null for other viewers. */
+      joinPreview: invitationJoinPreviewSchema.nullable(),
+      /**
+       * True when the preview could not be computed for a pending
+       * invitee-viewed invitation. Accepting may still move owned workspaces,
+       * so the client must fall back to a generic migration notice rather
+       * than treating the missing preview as "nothing moves".
+       */
+      joinPreviewUnavailable: z.boolean().optional(),
     }),
   },
 })
 
+/**
+ * A pending invitation plus what accepting it will actually do. The preview
+ * rides along so the in-app list can disclose the workspace migration and echo
+ * `disclosedWorkspaceIds` on accept, exactly like the emailed `/invite` page —
+ * an accept surface without it would sweep workspaces without consent. `null`
+ * when the preview could not be computed; the client then shows the generic
+ * notice rather than treating it as "nothing moves".
+ */
+export const myInvitationSchema = invitationDetailsSchema.extend({
+  joinPreview: invitationJoinPreviewSchema.nullable(),
+})
+
+export type MyInvitation = z.output<typeof myInvitationSchema>
+
 export const listMyInvitationsContract = defineRouteContract({
   method: 'GET',
   path: '/api/invitations',
   response: {
     mode: 'json',
     schema: z.object({
-      invitations: z.array(invitationDetailsSchema),
+      invitations: z.array(myInvitationSchema),
     }),
   },
 })
@@ -188,13 +288,29 @@ export const rejectInvitationContract = defineRouteContract({
   },
 })
 
+/**
+ * `workspaceId` scopes the revocation to one granted workspace, which is all a
+ * workspace-level member list can authorize. Omitting it revokes the entire
+ * invitation and requires authority over all of it — see the route.
+ */
+export const cancelInvitationQuerySchema = z.object({
+  workspaceId: workspaceIdSchema.optional(),
+})
+
 export const cancelInvitationContract = defineRouteContract({
   method: 'DELETE',
   path: '/api/invitations/[id]',
   params: invitationParamsSchema,
+  query: cancelInvitationQuerySchema,
   response: {
     mode: 'json',
-    schema: successResponseSchema,
+    schema: successResponseSchema.extend({
+      /**
+       * False when only one workspace's grant was removed and the invitation is
+       * still pending for its remaining workspaces.
+       */
+      invitationCancelled: z.boolean(),
+    }),
   },
 })
 
@@ -222,3 +338,4 @@ export const removeWorkspaceMemberContract = defineRouteContract({
 export type PendingInvitationRow = z.infer<typeof pendingWorkspaceInvitationSchema>
 export type BatchInvitationResult = z.infer<typeof batchInvitationResultSchema>
 export type InvitationDetails = z.infer<typeof invitationDetailsSchema>
+export type InvitationJoinPreview = z.infer<typeof invitationJoinPreviewSchema>
diff --git a/apps/sim/lib/api/contracts/organization.ts b/apps/sim/lib/api/contracts/organization.ts
index ccaebe8547f..5bdd6476dfc 100644
--- a/apps/sim/lib/api/contracts/organization.ts
+++ b/apps/sim/lib/api/contracts/organization.ts
@@ -9,14 +9,6 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 import { workspacePermissionSchema } from '@/lib/api/contracts/workspaces'
 import { HEX_COLOR_REGEX } from '@/lib/branding'
 
-const booleanQueryParamSchema = z
-  .preprocess((value) => {
-    if (value === 'true') return true
-    if (value === 'false') return false
-    return value
-  }, z.boolean())
-  .optional()
-
 const numericResponseSchema = z.preprocess((value) => {
   if (typeof value !== 'string') return value
   const parsed = Number.parseFloat(value)
@@ -41,11 +33,6 @@ export const organizationMemberQuerySchema = z
   })
   .passthrough()
 
-export const workspaceGrantSchema = z.object({
-  workspaceId: z.string().min(1),
-  permission: workspacePermissionSchema,
-})
-
 export const createOrganizationBodySchema = z
   .object({
     name: z.string().optional(),
@@ -67,33 +54,10 @@ export const updateOrganizationBodySchema = z.object({
   logo: z.string().nullable().optional(),
 })
 
-export const createOrganizationInvitationBodySchema = z
-  .object({
-    email: z.string().optional(),
-    emails: z.array(z.string()).optional(),
-    role: z.enum(['member', 'admin'], { error: 'Invalid role' }).optional(),
-    workspaceInvitations: z.array(workspaceGrantSchema).optional(),
-  })
-  .passthrough()
-
-export const organizationInvitationsQuerySchema = z
-  .object({
-    validate: booleanQueryParamSchema,
-    batch: booleanQueryParamSchema,
-  })
-  .passthrough()
-
 export const updateOrganizationMemberRoleBodySchema = z.object({
   role: organizationRoleSchema,
 })
 
-export const inviteOrganizationMemberBodySchema = z
-  .object({
-    email: z.string({ error: 'Email is required' }).min(1, 'Email is required'),
-    role: z.enum(['admin', 'member'], { error: 'Invalid role' }).optional(),
-  })
-  .passthrough()
-
 const organizationDataRetentionHoursSchema = z
   .number()
   .int()
@@ -361,15 +325,6 @@ const successResponseSchema = z
   })
   .passthrough()
 
-const organizationInvitationValidationResponseSchema = z
-  .object({
-    success: z.literal(true),
-    data: z.unknown(),
-    validatedBy: z.string(),
-    validatedAt: z.string(),
-  })
-  .passthrough()
-
 export const getOrganizationRosterContract = defineRouteContract({
   method: 'GET',
   path: '/api/organizations/[id]/roster',
@@ -383,73 +338,46 @@ export const getOrganizationRosterContract = defineRouteContract({
   },
 })
 
-export const listOrganizationMembersContract = defineRouteContract({
-  method: 'GET',
-  path: '/api/organizations/[id]/members',
-  params: organizationParamsSchema,
-  query: organizationMemberQuerySchema,
-  response: {
-    mode: 'json',
-    schema: listOrganizationMembersResponseSchema,
-  },
+export const removalImpactCredentialSchema = z.object({
+  id: z.string(),
+  displayName: z.string(),
+  type: z.string(),
+  workspaceId: z.string(),
 })
 
-export const inviteOrganizationMemberContract = defineRouteContract({
-  method: 'POST',
-  path: '/api/organizations/[id]/members',
+export const memberRemovalImpactQuerySchema = z.object({
+  userId: z.string().min(1, 'User ID is required'),
+})
+
+/**
+ * Identity-bound credentials (OAuth accounts, personal env keys) the user owns
+ * in organization workspaces. These stop working when the user's workspace
+ * access is revoked and must be reconnected by a remaining member — removal is
+ * never blocked, only disclosed.
+ */
+export const getMemberRemovalImpactContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/organizations/[id]/removal-impact',
   params: organizationParamsSchema,
-  body: inviteOrganizationMemberBodySchema,
+  query: memberRemovalImpactQuerySchema,
   response: {
     mode: 'json',
-    schema: successResponseSchema.extend({
-      data: z
-        .object({
-          invitationId: z.string(),
-          email: z.string(),
-          role: organizationRoleSchema,
-        })
-        .passthrough()
-        .optional(),
+    schema: z.object({
+      credentials: z.array(removalImpactCredentialSchema),
     }),
   },
 })
 
-export const inviteOrganizationMembersContract = defineRouteContract({
-  method: 'POST',
-  path: '/api/organizations/[id]/invitations',
+export type RemovalImpactCredential = z.infer<typeof removalImpactCredentialSchema>
+
+export const listOrganizationMembersContract = defineRouteContract({
+  method: 'GET',
+  path: '/api/organizations/[id]/members',
   params: organizationParamsSchema,
-  query: organizationInvitationsQuerySchema,
-  body: createOrganizationInvitationBodySchema,
+  query: organizationMemberQuerySchema,
   response: {
     mode: 'json',
-    schema: z.union([
-      organizationInvitationValidationResponseSchema,
-      successResponseSchema.extend({
-        error: z.string().optional(),
-        data: z
-          .object({
-            invitationsSent: z.number(),
-            invitedEmails: z.array(z.string()),
-            directlyAdded: z.array(z.string()).optional(),
-            directlyAddedCount: z.number().optional(),
-            failedInvitations: z.array(z.object({ email: z.string(), error: z.string() })),
-            existingMembers: z.array(z.string()),
-            pendingInvitations: z.array(z.string()),
-            invalidEmails: z.array(z.string()),
-            workspaceGrantsPerInvite: z.number(),
-            seatInfo: z
-              .object({
-                seatsUsed: z.number(),
-                maxSeats: z.number(),
-                availableSeats: z.number(),
-              })
-              .passthrough()
-              .optional(),
-          })
-          .passthrough()
-          .optional(),
-      }),
-    ]),
+    schema: listOrganizationMembersResponseSchema,
   },
 })
 
diff --git a/apps/sim/lib/api/contracts/v1/admin/dashboard-workspaces.ts b/apps/sim/lib/api/contracts/v1/admin/dashboard-workspaces.ts
index f8abf20fd83..4818e11688a 100644
--- a/apps/sim/lib/api/contracts/v1/admin/dashboard-workspaces.ts
+++ b/apps/sim/lib/api/contracts/v1/admin/dashboard-workspaces.ts
@@ -35,6 +35,8 @@ const adminDashboardWorkspaceCandidateSchema = z.object({
   workspaceMode: z.string(),
   organizationId: z.string().nullable(),
   billedAccountUserId: z.string(),
+  /** Archived workspaces are movable; the flag lets admin UIs label them. */
+  archived: z.boolean(),
 })
 
 const adminDashboardWorkspacePreflightSchema = z.object({
diff --git a/apps/sim/lib/api/contracts/v1/admin/dashboard.ts b/apps/sim/lib/api/contracts/v1/admin/dashboard.ts
index a7315ed4b94..06f154fa569 100644
--- a/apps/sim/lib/api/contracts/v1/admin/dashboard.ts
+++ b/apps/sim/lib/api/contracts/v1/admin/dashboard.ts
@@ -172,7 +172,9 @@ export const adminDashboardMemberPreflightQuerySchema = z.object({
 export const adminDashboardMemberPreflightSchema = z.object({
   user: z.object({ id: z.string(), name: z.string(), email: z.string() }),
   currentOrganization: z.object({ id: z.string(), name: z.string(), role: z.string() }).nullable(),
-  personalWorkspaces: z.array(z.object({ id: z.string(), name: z.string() })),
+  personalWorkspaces: z.array(
+    z.object({ id: z.string(), name: z.string(), archived: z.boolean() })
+  ),
   credentialDependencies: z.array(
     z.object({
       id: z.string(),
diff --git a/apps/sim/lib/api/contracts/workspaces.ts b/apps/sim/lib/api/contracts/workspaces.ts
index 47567a624ed..9cc7e41ab11 100644
--- a/apps/sim/lib/api/contracts/workspaces.ts
+++ b/apps/sim/lib/api/contracts/workspaces.ts
@@ -38,6 +38,11 @@ export const workspaceCreationPolicySchema = z.object({
   maxWorkspaces: z.number().nullable(),
   currentWorkspaceCount: z.number(),
   reason: z.string().nullable(),
+  /**
+   * Machine-readable discriminant for blocked states whose correct user-facing
+   * copy the workspace mode alone cannot determine.
+   */
+  blockedReasonCode: z.literal('organization-subscription-inactive').optional(),
 })
 
 export type WorkspaceCreationPolicy = z.output<typeof workspaceCreationPolicySchema>
diff --git a/apps/sim/lib/billing/core/organization.ts b/apps/sim/lib/billing/core/organization.ts
index ca09e106c3d..7290bf1d9dc 100644
--- a/apps/sim/lib/billing/core/organization.ts
+++ b/apps/sim/lib/billing/core/organization.ts
@@ -1,7 +1,7 @@
 import { db } from '@sim/db'
-import { invitation, member, organization, user, userStats } from '@sim/db/schema'
+import { member, organization, user, userStats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, count, eq, gt, ne } from 'drizzle-orm'
+import { eq } from 'drizzle-orm'
 import { isOrganizationBillingBlocked } from '@/lib/billing/core/access'
 import { getOrganizationSubscription, getPlanPricing } from '@/lib/billing/core/billing'
 import {
@@ -19,6 +19,7 @@ import {
   hasUsableSubscriptionStatus,
 } from '@/lib/billing/subscriptions/utils'
 import { toDecimal, toNumber } from '@/lib/billing/utils/decimal'
+import { countPendingSeatInvitations } from '@/lib/billing/validation/seat-management'
 import type { DbClient } from '@/lib/db/types'
 import { isOrganizationAdminOrOwner } from '@/lib/workspaces/permissions/utils'
 
@@ -235,18 +236,8 @@ export async function getOrganizationBillingData(
 
     const averageUsagePerMember = members.length > 0 ? totalCurrentUsage / members.length : 0
 
-    const [pendingInvitationCount] = await executor
-      .select({ count: count() })
-      .from(invitation)
-      .where(
-        and(
-          eq(invitation.organizationId, organizationId),
-          eq(invitation.status, 'pending'),
-          ne(invitation.membershipIntent, 'external'),
-          gt(invitation.expiresAt, new Date())
-        )
-      )
-    const usedSeats = members.length + (pendingInvitationCount?.count ?? 0)
+    const pendingSeats = await countPendingSeatInvitations(organizationId, executor)
+    const usedSeats = members.length + pendingSeats
 
     const billingPeriodStart = subscription.periodStart || null
     const billingPeriodEnd = subscription.periodEnd || null
@@ -401,7 +392,11 @@ async function getOrganizationBillingSummary(organizationId: string) {
       seats: {
         total: billingData.totalSeats,
         used: billingData.usedSeats,
-        available: billingData.totalSeats - billingData.usedSeats,
+        /**
+         * Clamped: Team seats track the member count rather than a ceiling, so
+         * any outstanding invitation would otherwise report negative headroom.
+         */
+        available: Math.max(0, billingData.totalSeats - billingData.usedSeats),
       },
       alerts: {
         membersOverLimit,
diff --git a/apps/sim/lib/billing/organization.test.ts b/apps/sim/lib/billing/organization.test.ts
index 8886f7b2975..aea983dff2b 100644
--- a/apps/sim/lib/billing/organization.test.ts
+++ b/apps/sim/lib/billing/organization.test.ts
@@ -172,6 +172,7 @@ describe('ensureOrganizationForTeamSubscription', () => {
       ownerUserId: 'user-1',
       organizationId: 'org-owned',
       externalMemberPolicy: 'keep-external',
+      includeArchived: true,
     })
     expect(mockCreateOrganizationWithOwner).not.toHaveBeenCalled()
   })
diff --git a/apps/sim/lib/billing/organization.ts b/apps/sim/lib/billing/organization.ts
index a7af195844b..6c51b8f9ec4 100644
--- a/apps/sim/lib/billing/organization.ts
+++ b/apps/sim/lib/billing/organization.ts
@@ -253,6 +253,7 @@ export async function ensureOrganizationForTeamSubscription(
         ownerUserId: userId,
         organizationId: membership.organizationId,
         externalMemberPolicy: 'keep-external',
+        includeArchived: true,
       })
 
       return { ...subscription, referenceId: membership.organizationId }
@@ -326,6 +327,7 @@ export async function ensureOrganizationForTeamSubscription(
     ownerUserId: userId,
     organizationId: orgId,
     externalMemberPolicy: 'keep-external',
+    includeArchived: true,
   })
 
   logger.info('Created organization and updated subscription referenceId', {
@@ -475,6 +477,7 @@ export async function ensureOrganizationForTeamSubscriptionTx(
     ownerUserId: userId,
     organizationId,
     workspaceIds: subscription.workspaceIdsToAttach,
+    includeArchived: true,
   })
 
   return {
diff --git a/apps/sim/lib/billing/organizations/membership.ts b/apps/sim/lib/billing/organizations/membership.ts
index 3cb64bedefc..ab144dce704 100644
--- a/apps/sim/lib/billing/organizations/membership.ts
+++ b/apps/sim/lib/billing/organizations/membership.ts
@@ -599,52 +599,6 @@ interface MembershipValidationResult {
   }
 }
 
-export async function ensureUserInOrganization(
-  params: AddMemberParams
-): Promise<EnsureMemberResult> {
-  const existingMembership = await getUserOrganization(params.userId)
-
-  if (existingMembership?.organizationId === params.organizationId) {
-    return {
-      success: true,
-      memberId: existingMembership.memberId,
-      alreadyMember: true,
-      billingActions: {
-        proUsageSnapshotted: false,
-        proCancelledAtPeriodEnd: false,
-      },
-    }
-  }
-
-  if (existingMembership) {
-    return {
-      success: false,
-      alreadyMember: false,
-      existingOrgId: existingMembership.organizationId,
-      failureCode: 'already-in-other-organization',
-      error:
-        'User is already a member of another organization. Users can only belong to one organization at a time.',
-      billingActions: {
-        proUsageSnapshotted: false,
-        proCancelledAtPeriodEnd: false,
-      },
-    }
-  }
-
-  const result = await addUserToOrganization(params)
-
-  if (result.success) {
-    // Invalidates the membership cache and clamps pre-join sessions to the
-    // org policy — same treatment as invite acceptance. Best-effort.
-    await applySessionPolicyToNewMember(params.userId, params.organizationId)
-  }
-
-  return {
-    ...result,
-    alreadyMember: false,
-  }
-}
-
 /**
  * Transaction-enlisted invitation acceptance path. Membership, personal-Pro
  * handling, invitation status, and workspace permissions all commit or roll
@@ -808,88 +762,6 @@ export async function ensureUserInOrganizationTx(
   }
 }
 
-/**
- * Validate if a user can be added to an organization.
- * Checks single-org constraint and seat availability.
- */
-async function validateMembershipAddition(
-  userId: string,
-  organizationId: string,
-  options: { acceptingInvitationId?: string } = {}
-): Promise<MembershipValidationResult> {
-  const [userData] = await db.select({ id: user.id }).from(user).where(eq(user.id, userId)).limit(1)
-
-  if (!userData) {
-    return { canAdd: false, reason: 'User not found', failureCode: 'user-not-found' }
-  }
-
-  const [orgData] = await db
-    .select({ id: organization.id })
-    .from(organization)
-    .where(eq(organization.id, organizationId))
-    .limit(1)
-
-  if (!orgData) {
-    return {
-      canAdd: false,
-      reason: 'Organization not found',
-      failureCode: 'organization-not-found',
-    }
-  }
-
-  const existingMemberships = await db
-    .select({ organizationId: member.organizationId })
-    .from(member)
-    .where(eq(member.userId, userId))
-
-  if (existingMemberships.length > 0) {
-    const isAlreadyMemberOfThisOrg = existingMemberships.some(
-      (m) => m.organizationId === organizationId
-    )
-
-    if (isAlreadyMemberOfThisOrg) {
-      return {
-        canAdd: false,
-        reason: 'User is already a member of this organization',
-        failureCode: 'already-member',
-      }
-    }
-
-    return {
-      canAdd: false,
-      reason:
-        'User is already a member of another organization. Users can only belong to one organization at a time.',
-      failureCode: 'already-in-other-organization',
-      existingOrgId: existingMemberships[0].organizationId,
-    }
-  }
-
-  const seatValidation = await validateSeatAvailability(organizationId, 1, {
-    excludePendingInvitationId: options.acceptingInvitationId,
-  })
-  if (!seatValidation.canInvite) {
-    return {
-      canAdd: false,
-      reason: seatValidation.reason || 'No seats available',
-      failureCode: 'no-seats-available',
-      seatValidation: {
-        currentSeats: seatValidation.currentSeats,
-        maxSeats: seatValidation.maxSeats,
-        availableSeats: seatValidation.availableSeats,
-      },
-    }
-  }
-
-  return {
-    canAdd: true,
-    seatValidation: {
-      currentSeats: seatValidation.currentSeats,
-      maxSeats: seatValidation.maxSeats,
-      availableSeats: seatValidation.availableSeats,
-    },
-  }
-}
-
 interface PaidOrgJoinBillingActions {
   proUsageSnapshotted: boolean
   proCancelledAtPeriodEnd: boolean
@@ -1047,113 +919,6 @@ export async function reapplyPaidOrgJoinBillingForExistingMemberTx(
   return applyPaidOrgJoinBillingTx(tx, userId, organizationId)
 }
 
-/**
- * Add a user to an organization with full billing logic.
- *
- * Handles:
- * - Single organization constraint validation
- * - Seat availability validation
- * - Member record creation
- * - Pro usage snapshot when joining paid team
- * - Pro subscription cancellation at period end
- * - Usage limit sync
- */
-export async function addUserToOrganization(params: AddMemberParams): Promise<AddMemberResult> {
-  const {
-    userId,
-    organizationId,
-    role,
-    skipBillingLogic = false,
-    skipSeatValidation = false,
-    acceptingInvitationId,
-  } = params
-
-  const billingActions: AddMemberResult['billingActions'] = {
-    proUsageSnapshotted: false,
-    proCancelledAtPeriodEnd: false,
-  }
-
-  try {
-    if (!skipSeatValidation) {
-      const validation = await validateMembershipAddition(userId, organizationId, {
-        acceptingInvitationId,
-      })
-      if (!validation.canAdd) {
-        return {
-          success: false,
-          error: validation.reason,
-          failureCode: validation.failureCode,
-          billingActions,
-        }
-      }
-    } else {
-      const existingMemberships = await db
-        .select({ organizationId: member.organizationId })
-        .from(member)
-        .where(eq(member.userId, userId))
-
-      if (existingMemberships.length > 0) {
-        const isAlreadyMemberOfThisOrg = existingMemberships.some(
-          (m) => m.organizationId === organizationId
-        )
-
-        if (isAlreadyMemberOfThisOrg) {
-          return {
-            success: false,
-            error: 'User is already a member of this organization',
-            failureCode: 'already-member',
-            billingActions,
-          }
-        }
-
-        return {
-          success: false,
-          error:
-            'User is already a member of another organization. Users can only belong to one organization at a time.',
-          failureCode: 'already-in-other-organization',
-          billingActions,
-        }
-      }
-    }
-
-    const added = await db.transaction((tx) =>
-      ensureUserInOrganizationTx(tx, {
-        userId,
-        organizationId,
-        role,
-        skipBillingLogic,
-        skipSeatValidation,
-        acceptingInvitationId,
-      })
-    )
-    if (!added.success || !added.memberId || added.alreadyMember) {
-      return {
-        success: false,
-        error: added.alreadyMember ? 'User is already a member of this organization' : added.error,
-        failureCode: added.alreadyMember ? 'already-member' : added.failureCode,
-        billingActions: added.billingActions,
-      }
-    }
-
-    const memberId = added.memberId
-    billingActions.proUsageSnapshotted = added.billingActions.proUsageSnapshotted
-    billingActions.proCancelledAtPeriodEnd = added.billingActions.proCancelledAtPeriodEnd
-
-    logger.info('Added user to organization', {
-      userId,
-      organizationId,
-      role,
-      memberId,
-      billingActions,
-    })
-
-    return { success: true, memberId, billingActions }
-  } catch (error) {
-    logger.error('Failed to add user to organization', { userId, organizationId, error })
-    return { success: false, error: 'Failed to add user to organization', billingActions }
-  }
-}
-
 type InvitationRemovalScope = 'all' | 'external'
 
 interface InvitationRemovalLockSnapshot {
@@ -2326,3 +2091,238 @@ export async function getUserOrganization(
 
   return memberRecord || null
 }
+
+export async function ensureUserInOrganization(
+  params: AddMemberParams
+): Promise<EnsureMemberResult> {
+  const existingMembership = await getUserOrganization(params.userId)
+
+  if (existingMembership?.organizationId === params.organizationId) {
+    return {
+      success: true,
+      memberId: existingMembership.memberId,
+      alreadyMember: true,
+      billingActions: {
+        proUsageSnapshotted: false,
+        proCancelledAtPeriodEnd: false,
+      },
+    }
+  }
+
+  if (existingMembership) {
+    return {
+      success: false,
+      alreadyMember: false,
+      existingOrgId: existingMembership.organizationId,
+      failureCode: 'already-in-other-organization',
+      error:
+        'User is already a member of another organization. Users can only belong to one organization at a time.',
+      billingActions: {
+        proUsageSnapshotted: false,
+        proCancelledAtPeriodEnd: false,
+      },
+    }
+  }
+
+  const result = await addUserToOrganization(params)
+
+  if (result.success) {
+    // Invalidates the membership cache and clamps pre-join sessions to the
+    // org policy — same treatment as invite acceptance. Best-effort.
+    await applySessionPolicyToNewMember(params.userId, params.organizationId)
+  }
+
+  return {
+    ...result,
+    alreadyMember: false,
+  }
+}
+
+/**
+ * Add a user to an organization with full billing logic.
+ *
+ * Handles:
+ * - Single organization constraint validation
+ * - Seat availability validation
+ * - Member record creation
+ * - Pro usage snapshot when joining paid team
+ * - Pro subscription cancellation at period end
+ * - Usage limit sync
+ */
+export async function addUserToOrganization(params: AddMemberParams): Promise<AddMemberResult> {
+  const {
+    userId,
+    organizationId,
+    role,
+    skipBillingLogic = false,
+    skipSeatValidation = false,
+    acceptingInvitationId,
+  } = params
+
+  const billingActions: AddMemberResult['billingActions'] = {
+    proUsageSnapshotted: false,
+    proCancelledAtPeriodEnd: false,
+  }
+
+  try {
+    if (!skipSeatValidation) {
+      const validation = await validateMembershipAddition(userId, organizationId, {
+        acceptingInvitationId,
+      })
+      if (!validation.canAdd) {
+        return {
+          success: false,
+          error: validation.reason,
+          failureCode: validation.failureCode,
+          billingActions,
+        }
+      }
+    } else {
+      const existingMemberships = await db
+        .select({ organizationId: member.organizationId })
+        .from(member)
+        .where(eq(member.userId, userId))
+
+      if (existingMemberships.length > 0) {
+        const isAlreadyMemberOfThisOrg = existingMemberships.some(
+          (m) => m.organizationId === organizationId
+        )
+
+        if (isAlreadyMemberOfThisOrg) {
+          return {
+            success: false,
+            error: 'User is already a member of this organization',
+            failureCode: 'already-member',
+            billingActions,
+          }
+        }
+
+        return {
+          success: false,
+          error:
+            'User is already a member of another organization. Users can only belong to one organization at a time.',
+          failureCode: 'already-in-other-organization',
+          billingActions,
+        }
+      }
+    }
+
+    const added = await db.transaction((tx) =>
+      ensureUserInOrganizationTx(tx, {
+        userId,
+        organizationId,
+        role,
+        skipBillingLogic,
+        skipSeatValidation,
+        acceptingInvitationId,
+      })
+    )
+    if (!added.success || !added.memberId || added.alreadyMember) {
+      return {
+        success: false,
+        error: added.alreadyMember ? 'User is already a member of this organization' : added.error,
+        failureCode: added.alreadyMember ? 'already-member' : added.failureCode,
+        billingActions: added.billingActions,
+      }
+    }
+
+    const memberId = added.memberId
+    billingActions.proUsageSnapshotted = added.billingActions.proUsageSnapshotted
+    billingActions.proCancelledAtPeriodEnd = added.billingActions.proCancelledAtPeriodEnd
+
+    logger.info('Added user to organization', {
+      userId,
+      organizationId,
+      role,
+      memberId,
+      billingActions,
+    })
+
+    return { success: true, memberId, billingActions }
+  } catch (error) {
+    logger.error('Failed to add user to organization', { userId, organizationId, error })
+    return { success: false, error: 'Failed to add user to organization', billingActions }
+  }
+}
+
+/**
+ * Validate if a user can be added to an organization.
+ * Checks single-org constraint and seat availability.
+ */
+async function validateMembershipAddition(
+  userId: string,
+  organizationId: string,
+  options: { acceptingInvitationId?: string } = {}
+): Promise<MembershipValidationResult> {
+  const [userData] = await db.select({ id: user.id }).from(user).where(eq(user.id, userId)).limit(1)
+
+  if (!userData) {
+    return { canAdd: false, reason: 'User not found', failureCode: 'user-not-found' }
+  }
+
+  const [orgData] = await db
+    .select({ id: organization.id })
+    .from(organization)
+    .where(eq(organization.id, organizationId))
+    .limit(1)
+
+  if (!orgData) {
+    return {
+      canAdd: false,
+      reason: 'Organization not found',
+      failureCode: 'organization-not-found',
+    }
+  }
+
+  const existingMemberships = await db
+    .select({ organizationId: member.organizationId })
+    .from(member)
+    .where(eq(member.userId, userId))
+
+  if (existingMemberships.length > 0) {
+    const isAlreadyMemberOfThisOrg = existingMemberships.some(
+      (m) => m.organizationId === organizationId
+    )
+
+    if (isAlreadyMemberOfThisOrg) {
+      return {
+        canAdd: false,
+        reason: 'User is already a member of this organization',
+        failureCode: 'already-member',
+      }
+    }
+
+    return {
+      canAdd: false,
+      reason:
+        'User is already a member of another organization. Users can only belong to one organization at a time.',
+      failureCode: 'already-in-other-organization',
+      existingOrgId: existingMemberships[0].organizationId,
+    }
+  }
+
+  const seatValidation = await validateSeatAvailability(organizationId, 1, {
+    excludePendingInvitationId: options.acceptingInvitationId,
+  })
+  if (!seatValidation.canInvite) {
+    return {
+      canAdd: false,
+      reason: seatValidation.reason || 'No seats available',
+      failureCode: 'no-seats-available',
+      seatValidation: {
+        currentSeats: seatValidation.currentSeats,
+        maxSeats: seatValidation.maxSeats,
+        availableSeats: seatValidation.availableSeats,
+      },
+    }
+  }
+
+  return {
+    canAdd: true,
+    seatValidation: {
+      currentSeats: seatValidation.currentSeats,
+      maxSeats: seatValidation.maxSeats,
+      availableSeats: seatValidation.availableSeats,
+    },
+  }
+}
diff --git a/apps/sim/lib/billing/validation/seat-management.ts b/apps/sim/lib/billing/validation/seat-management.ts
index 7089e2bacd8..9bc0c17713d 100644
--- a/apps/sim/lib/billing/validation/seat-management.ts
+++ b/apps/sim/lib/billing/validation/seat-management.ts
@@ -1,7 +1,6 @@
 import { db } from '@sim/db'
-import { invitation, member, organization, subscription, user } from '@sim/db/schema'
+import { invitation, member, organization, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { normalizeEmail } from '@sim/utils/string'
 import { and, count, eq, gt, ne } from 'drizzle-orm'
 import { getOrganizationSubscription } from '@/lib/billing/core/billing'
 import { resolveEnterpriseMetadataIntent } from '@/lib/billing/enterprise-outbox'
@@ -10,7 +9,7 @@ import { getEffectiveSeats } from '@/lib/billing/subscriptions/utils'
 import { OUTBOX_EVENT_TYPES } from '@/lib/billing/webhooks/outbox-handlers'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { hasInflightOutboxEvent } from '@/lib/core/outbox/service'
-import { quickValidateEmail } from '@/lib/messaging/email/validation'
+import type { DbOrTx } from '@/lib/db/types'
 
 const logger = createLogger('SeatManagement')
 
@@ -36,6 +35,105 @@ interface ValidateSeatOptions {
   excludePendingInvitationId?: string
 }
 
+/**
+ * Counts the pending invitations that stand to become seats.
+ *
+ * The single definition of that predicate: still `pending`, not yet expired, and
+ * internal — external collaborators never take a seat. Every seat number in the
+ * product derives from this one count so no two surfaces can drift.
+ */
+export async function countPendingSeatInvitations(
+  organizationId: string,
+  executor: DbOrTx = db,
+  excludePendingInvitationId?: string
+): Promise<number> {
+  const filters = [
+    eq(invitation.organizationId, organizationId),
+    eq(invitation.status, 'pending'),
+    ne(invitation.membershipIntent, 'external'),
+    gt(invitation.expiresAt, new Date()),
+  ]
+  if (excludePendingInvitationId) {
+    filters.push(ne(invitation.id, excludePendingInvitationId))
+  }
+  const [row] = await executor
+    .select({ count: count() })
+    .from(invitation)
+    .where(and(...filters))
+  return row?.count ?? 0
+}
+
+/**
+ * Resolves the organization's seat capacity, honouring an Enterprise seat
+ * change that is still in flight to Stripe.
+ */
+async function resolveSeatCapacity(
+  organizationSubscription: { id: string; plan: string; metadata?: unknown } & Record<
+    string,
+    unknown
+  >,
+  executor: DbOrTx = db
+): Promise<number> {
+  const canonicalSeats = getEffectiveSeats(organizationSubscription)
+  if (!isEnterprise(organizationSubscription.plan)) return canonicalSeats
+  const intent = await resolveEnterpriseMetadataIntent(
+    executor,
+    organizationSubscription.id,
+    organizationSubscription.metadata
+  )
+  return intent?.effectiveSeatCapacity ?? canonicalSeats
+}
+
+/**
+ * Whether the plan has a seat cap that can actually be exhausted.
+ *
+ * Only Enterprise does. Team seats are billed per member and grown on demand,
+ * so its `subscription.seats` tracks the current member count rather than a
+ * ceiling — comparing usage against it would always read as "full". Surfaces
+ * that gate or visualise remaining capacity must branch on this.
+ */
+export function planHasFixedSeatCap(plan: string | undefined | null): boolean {
+  return isEnterprise(plan)
+}
+
+/**
+ * Derives the seat figures every surface should report, from one rule.
+ *
+ * `usedSeats` stays members + pending so the wire meaning is unchanged, while
+ * the two components are exposed separately because the UI legitimately needs
+ * to distinguish "occupied" from "promised". `availableSeats` is only meaningful
+ * under a fixed cap, and is clamped at zero so an elastic plan can never report
+ * negative headroom.
+ */
+export function computeSeatUsage({
+  memberSeats,
+  pendingSeats,
+  totalSeats,
+  hasFixedSeatCap,
+}: {
+  memberSeats: number
+  pendingSeats: number
+  totalSeats: number
+  hasFixedSeatCap: boolean
+}): {
+  memberSeats: number
+  pendingSeats: number
+  usedSeats: number
+  totalSeats: number
+  availableSeats: number
+  hasFixedSeatCap: boolean
+} {
+  const usedSeats = memberSeats + pendingSeats
+  return {
+    memberSeats,
+    pendingSeats,
+    usedSeats,
+    totalSeats,
+    availableSeats: Math.max(0, totalSeats - usedSeats),
+    hasFixedSeatCap,
+  }
+}
+
 export async function validateSeatAvailability(
   organizationId: string,
   additionalSeats = 1,
@@ -43,14 +141,13 @@ export async function validateSeatAvailability(
 ): Promise<SeatValidationResult> {
   try {
     if (!isBillingEnabled) {
-      const memberCount = await db
-        .select({ count: count() })
-        .from(member)
-        .where(eq(member.organizationId, organizationId))
-      const currentSeats = memberCount[0]?.count || 0
+      const [memberCount, pendingSeats] = await Promise.all([
+        db.select({ count: count() }).from(member).where(eq(member.organizationId, organizationId)),
+        countPendingSeatInvitations(organizationId),
+      ])
       return {
         canInvite: true,
-        currentSeats,
+        currentSeats: (memberCount[0]?.count ?? 0) + pendingSeats,
         maxSeats: Number.MAX_SAFE_INTEGER,
         availableSeats: Number.MAX_SAFE_INTEGER,
       }
@@ -78,34 +175,27 @@ export async function validateSeatAvailability(
       }
     }
 
-    const [memberCount] = await db
-      .select({ count: count() })
-      .from(member)
-      .where(eq(member.organizationId, organizationId))
-
-    const pendingFilters = [
-      eq(invitation.organizationId, organizationId),
-      eq(invitation.status, 'pending'),
-      ne(invitation.membershipIntent, 'external'),
-      gt(invitation.expiresAt, new Date()),
-    ]
-    if (options.excludePendingInvitationId) {
-      pendingFilters.push(ne(invitation.id, options.excludePendingInvitationId))
-    }
-    const [pendingCount] = await db
-      .select({ count: count() })
-      .from(invitation)
-      .where(and(...pendingFilters))
-
-    const currentSeats = (memberCount?.count ?? 0) + (pendingCount?.count ?? 0)
+    const [memberCount, pendingSeats, maxSeats] = await Promise.all([
+      db.select({ count: count() }).from(member).where(eq(member.organizationId, organizationId)),
+      countPendingSeatInvitations(organizationId, db, options.excludePendingInvitationId),
+      resolveSeatCapacity(subscription),
+    ])
 
-    const canonicalSeats = getEffectiveSeats(subscription)
-    const intent = isEnterprise(subscription.plan)
-      ? await resolveEnterpriseMetadataIntent(db, subscription.id, subscription.metadata)
-      : null
-    const maxSeats = intent?.effectiveSeatCapacity ?? canonicalSeats
-    const availableSeats = Math.max(0, maxSeats - currentSeats)
-    const canInvite = availableSeats >= additionalSeats
+    const {
+      usedSeats: currentSeats,
+      availableSeats,
+      hasFixedSeatCap,
+    } = computeSeatUsage({
+      memberSeats: memberCount[0]?.count ?? 0,
+      pendingSeats,
+      totalSeats: maxSeats,
+      hasFixedSeatCap: planHasFixedSeatCap(subscription.plan),
+    })
+    /**
+     * Only a fixed cap can refuse an invite. Team seats are provisioned when the
+     * invitee accepts, so there is nothing to run out of at invite time.
+     */
+    const canInvite = !hasFixedSeatCap || availableSeats >= additionalSeats
 
     const result: SeatValidationResult = {
       canInvite,
@@ -166,19 +256,9 @@ export async function getOrganizationSeatInfo(
       .from(member)
       .where(eq(member.organizationId, organizationId))
 
-    const [pendingCountRow] = await db
-      .select({ count: count() })
-      .from(invitation)
-      .where(
-        and(
-          eq(invitation.organizationId, organizationId),
-          eq(invitation.status, 'pending'),
-          ne(invitation.membershipIntent, 'external'),
-          gt(invitation.expiresAt, new Date())
-        )
-      )
-
-    const currentSeats = (memberCountRow?.count ?? 0) + (pendingCountRow?.count ?? 0)
+    const memberSeats = memberCountRow?.count ?? 0
+    const pendingSeats = await countPendingSeatInvitations(organizationId)
+    const currentSeats = memberSeats + pendingSeats
 
     if (!isBillingEnabled) {
       return {
@@ -198,15 +278,13 @@ export async function getOrganizationSeatInfo(
       return null
     }
 
-    const canonicalSeats = getEffectiveSeats(subscription)
-    const intent = isEnterprise(subscription.plan)
-      ? await resolveEnterpriseMetadataIntent(db, subscription.id, subscription.metadata)
-      : null
-    const maxSeats = intent?.effectiveSeatCapacity ?? canonicalSeats
-
-    const canAddSeats = !isEnterprise(subscription.plan)
-
-    const availableSeats = Math.max(0, maxSeats - currentSeats)
+    const maxSeats = await resolveSeatCapacity(subscription)
+    const { availableSeats } = computeSeatUsage({
+      memberSeats,
+      pendingSeats,
+      totalSeats: maxSeats,
+      hasFixedSeatCap: planHasFixedSeatCap(subscription.plan),
+    })
 
     return {
       organizationId,
@@ -215,7 +293,7 @@ export async function getOrganizationSeatInfo(
       maxSeats,
       availableSeats,
       subscriptionPlan: subscription.plan,
-      canAddSeats,
+      canAddSeats: !isEnterprise(subscription.plan),
     }
   } catch (error) {
     logger.error('Failed to get organization seat info', { organizationId, error })
@@ -223,91 +301,6 @@ export async function getOrganizationSeatInfo(
   }
 }
 
-/**
- * Validate and reserve seats for bulk invitations
- */
-export async function validateBulkInvitations(
-  organizationId: string,
-  emailList: string[]
-): Promise<{
-  canInviteAll: boolean
-  validEmails: string[]
-  duplicateEmails: string[]
-  existingMembers: string[]
-  seatsNeeded: number
-  seatsAvailable: number
-  validationResult: SeatValidationResult
-}> {
-  try {
-    const uniqueEmails = [...new Set(emailList)]
-    const validEmails = uniqueEmails.filter(
-      (email) => quickValidateEmail(normalizeEmail(email)).isValid
-    )
-    const duplicateEmails = emailList.filter((email, index) => emailList.indexOf(email) !== index)
-
-    const existingMembers = await db
-      .select({ userEmail: user.email })
-      .from(member)
-      .innerJoin(user, eq(member.userId, user.id))
-      .where(eq(member.organizationId, organizationId))
-
-    const existingEmails = existingMembers.map((m) => m.userEmail)
-    const newEmails = validEmails.filter((email) => !existingEmails.includes(email))
-
-    const pendingInvitations = await db
-      .select({ email: invitation.email })
-      .from(invitation)
-      .where(
-        and(
-          eq(invitation.organizationId, organizationId),
-          eq(invitation.status, 'pending'),
-          ne(invitation.membershipIntent, 'external'),
-          gt(invitation.expiresAt, new Date())
-        )
-      )
-
-    const pendingEmails = pendingInvitations.map((i) => i.email)
-    const finalEmailsToInvite = newEmails.filter((email) => !pendingEmails.includes(email))
-
-    const seatsNeeded = finalEmailsToInvite.length
-    const validationResult = await validateSeatAvailability(organizationId, seatsNeeded)
-
-    return {
-      canInviteAll: validationResult.canInvite && finalEmailsToInvite.length > 0,
-      validEmails: finalEmailsToInvite,
-      duplicateEmails,
-      existingMembers: validEmails.filter((email) => existingEmails.includes(email)),
-      seatsNeeded,
-      seatsAvailable: validationResult.availableSeats,
-      validationResult,
-    }
-  } catch (error) {
-    logger.error('Failed to validate bulk invitations', {
-      organizationId,
-      emailCount: emailList.length,
-      error,
-    })
-
-    const validationResult: SeatValidationResult = {
-      canInvite: false,
-      reason: 'Validation failed',
-      currentSeats: 0,
-      maxSeats: 0,
-      availableSeats: 0,
-    }
-
-    return {
-      canInviteAll: false,
-      validEmails: [],
-      duplicateEmails: [],
-      existingMembers: [],
-      seatsNeeded: 0,
-      seatsAvailable: 0,
-      validationResult,
-    }
-  }
-}
-
 /**
  * Get seat usage analytics for an organization
  */
diff --git a/apps/sim/lib/invitations/core.test.ts b/apps/sim/lib/invitations/core.test.ts
index 0535f6632cd..f824fa652ae 100644
--- a/apps/sim/lib/invitations/core.test.ts
+++ b/apps/sim/lib/invitations/core.test.ts
@@ -23,6 +23,8 @@ const {
   mockSyncUsageLimitsFromSubscription,
   mockSyncWorkspaceEnvCredentials,
   mockIsWorkspaceOnEnterprisePlan,
+  mockAttachOwnedWorkspacesToOrganizationTx,
+  mockGetInvitePlanCategoryForUser,
 } = vi.hoisted(() => ({
   mockEnsureUserInOrganization: vi.fn(),
   mockGetUserOrganization: vi.fn(),
@@ -35,6 +37,9 @@ const {
   mockSyncUsageLimitsFromSubscription: vi.fn(),
   mockSyncWorkspaceEnvCredentials: vi.fn(),
   mockIsWorkspaceOnEnterprisePlan: vi.fn(async () => true),
+  mockAttachOwnedWorkspacesToOrganizationTx: vi.fn(),
+  /** Externals must be on a paid plan; invite-time enforces it, accept re-checks. */
+  mockGetInvitePlanCategoryForUser: vi.fn(async () => 'pro'),
 }))
 
 vi.mock('@/lib/billing/organizations/membership', () => ({
@@ -72,6 +77,15 @@ vi.mock('@/lib/credentials/environment', () => ({
   syncWorkspaceEnvCredentials: mockSyncWorkspaceEnvCredentials,
 }))
 
+vi.mock('@/lib/workspaces/organization-workspaces', () => ({
+  attachOwnedWorkspacesToOrganizationTx: mockAttachOwnedWorkspacesToOrganizationTx,
+  ownedAttachableWorkspacesWhere: vi.fn(),
+}))
+
+vi.mock('@/lib/workspaces/policy', () => ({
+  getInvitePlanCategoryForUser: mockGetInvitePlanCategoryForUser,
+}))
+
 vi.mock('@sim/audit', () => auditMock)
 
 import { acceptInvitation } from '@/lib/invitations/core'
@@ -125,6 +139,180 @@ describe('acceptInvitation', () => {
       alreadyMember: false,
       billingActions: { proUsageSnapshotted: false, proCancelledAtPeriodEnd: false },
     })
+    mockAttachOwnedWorkspacesToOrganizationTx.mockResolvedValue({
+      attachedWorkspaceIds: [],
+      addedMemberIds: [],
+      skippedMembers: [],
+      usageLimitUserIds: [],
+    })
+  })
+
+  it('rejects when the disclosed join outcome no longer matches (empty sweep set)', async () => {
+    /**
+     * The workspace-id token cannot express this: the invitee owns nothing, so
+     * both a no-join and a will-join preview disclose []. Without the explicit
+     * membership half of the token, leaving another org between preview and
+     * accept would silently create a seat-consuming membership the screen said
+     * would stay external.
+     */
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'inviter-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Inviter', email: 'inviter@example.com' }],
+      [],
+      [],
+      [{ variables: {} }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      actorName: 'Invitee',
+      // The screen promised "you will not join" — acceptance resolves to a join.
+      disclosedWorkspaceIds: [],
+      disclosedOutcome: 'external' as const,
+      request: new Request('http://localhost/api/invitations/inv-1/accept'),
+    })
+
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.kind).toBe('disclosure-outdated')
+    }
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+  })
+
+  it('accepts a forced-external invitation from a free invitee already in another org', async () => {
+    /**
+     * Cross-org invitees are stamped external regardless of the inviter's
+     * choice, so invite time never applies the paid-plan gate to them. Accept
+     * must not apply it either, or a Member invite would send cleanly and then
+     * be unacceptable.
+     */
+    mockGetUserOrganization.mockResolvedValueOnce({
+      organizationId: 'org-2',
+      role: 'member',
+      memberId: 'member-2',
+    })
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'external@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'external',
+          inviterId: 'inviter-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Inviter', email: 'inviter@example.com' }],
+      [],
+      [],
+      [{ variables: {} }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'external-user',
+      userEmail: 'external@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      actorName: 'External User',
+      request: new Request('http://localhost/api/invitations/inv-1/accept'),
+    })
+
+    expect(result.success).toBe(true)
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+    /** The plan requirement must not even be evaluated for imposed externality. */
+    expect(mockGetInvitePlanCategoryForUser).not.toHaveBeenCalled()
+  })
+
+  it('rejects an external invitation when the invitee is no longer on a paid plan', async () => {
+    mockGetInvitePlanCategoryForUser.mockResolvedValueOnce('free')
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'external@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'external',
+          inviterId: 'inviter-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Inviter', email: 'inviter@example.com' }],
+      [],
+      [],
+      [{ variables: {} }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'external-user',
+      userEmail: 'external@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      actorName: 'External User',
+      request: new Request('http://localhost/api/invitations/inv-1/accept'),
+    })
+
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      expect(result.kind).toBe('external-requires-paid-plan')
+    }
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
   })
 
   it('accepts external workspace invitations without joining the organization', async () => {
@@ -211,6 +399,70 @@ describe('acceptInvitation', () => {
     )
   })
 
+  it('accepts a personal-workspace invite on a billing-disabled deployment', async () => {
+    /**
+     * With billing off and no organization on the workspace there is nothing to
+     * provision and nothing to join, so the preview reports `external`. The
+     * consent guard must agree: `shouldJoinOrganization` is still true at that
+     * point (it is only cleared much later), so deriving the predicate from it
+     * alone rejected every self-hosted personal invite as `disclosure-outdated`,
+     * with a retry that rendered the same preview.
+     */
+    setEnvFlags({ isBillingEnabled: false })
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: null,
+      workspaceMode: 'personal',
+      billedAccountUserId: 'owner-1',
+    })
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: null,
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      [],
+      [],
+      [{ variables: {} }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      disclosedWorkspaceIds: [],
+      disclosedOutcome: 'external',
+      request: new Request('http://localhost/api/invitations/inv-1/accept'),
+    })
+
+    expect(result.success ? 'ok' : result.kind).toBe('ok')
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+  })
+
   it('preserves a personal workspace organization null for external invitations', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',
@@ -306,6 +558,8 @@ describe('acceptInvitation', () => {
       ],
       [{ name: 'Acme' }],
       [{ name: 'Inviter', email: 'inviter@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
       [],
       [],
       [{ variables: {} }],
@@ -444,8 +698,12 @@ describe('acceptInvitation', () => {
       ],
       [{ name: 'Stale organization' }],
       [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
       // Candidate personal workspaces covered by the acceptance lock set.
       [],
+      // Post-join owned-set re-check under the billing-identity lock.
+      [],
       // Grant-txn membership re-check under the lock: member still present.
       [{ id: 'member-1' }],
     ])
@@ -516,6 +774,15 @@ describe('acceptInvitation', () => {
         workspaceMode: 'organization',
         billedAccountUserId: 'destination-owner',
       })
+    // The stamped organization (null) no longer matches the post-lock
+    // workspace organization, so escalation requires the inviter to hold
+    // admin standing in the destination org — as the conversion's billing
+    // owner does.
+    mockGetUserOrganization.mockImplementation(async (userId: string) =>
+      userId === 'owner-1'
+        ? { organizationId: 'org-1', role: 'owner', memberId: 'member-owner' }
+        : null
+    )
 
     queueWhereResponses([
       [
@@ -543,6 +810,10 @@ describe('acceptInvitation', () => {
         },
       ],
       [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
+      [],
+      // Post-join owned-set re-check under the billing-identity lock.
       [],
       [{ id: 'member-1' }],
       [],
@@ -570,7 +841,7 @@ describe('acceptInvitation', () => {
     })
   })
 
-  it('does not record an ORG_MEMBER_ADDED audit for a user who is already a member', async () => {
+  it('still sweeps when the same transaction auto-joined the invitee', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',
       name: 'Workspace',
@@ -579,6 +850,12 @@ describe('acceptInvitation', () => {
       workspaceMode: 'organization',
       billedAccountUserId: 'owner-1',
     })
+    /**
+     * No membership before acceptance, but ensureUserInOrganizationTx reports
+     * alreadyMember — i.e. the Pro→Team conversion's keep-external attach
+     * joined this collaborator moments earlier in the same transaction. The
+     * sweep and the seat reconcile must still run.
+     */
     mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
       success: true,
       organizationId: 'org-1',
@@ -589,6 +866,12 @@ describe('acceptInvitation', () => {
       alreadyMember: true,
       billingActions: { proUsageSnapshotted: false, proCancelledAtPeriodEnd: false },
     })
+    mockAttachOwnedWorkspacesToOrganizationTx.mockResolvedValueOnce({
+      attachedWorkspaceIds: ['joiner-ws-1'],
+      addedMemberIds: [],
+      skippedMembers: [],
+      usageLimitUserIds: [],
+    })
 
     queueWhereResponses([
       [
@@ -617,6 +900,11 @@ describe('acceptInvitation', () => {
       ],
       [{ name: 'Acme' }],
       [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [{ id: 'joiner-ws-1' }],
+      // Post-join owned-set re-check under the billing-identity lock.
+      [{ id: 'joiner-ws-1' }],
+      // Grant-txn membership re-check under the lock: member still present.
       [{ id: 'member-1' }],
     ])
 
@@ -628,15 +916,14 @@ describe('acceptInvitation', () => {
     })
 
     expect(result.success).toBe(true)
-    if (result.success) {
-      expect(result.membershipAlreadyExists).toBe(true)
-    }
-    expect(auditMock.recordAudit).not.toHaveBeenCalledWith(
-      expect.objectContaining({ action: auditMock.AuditAction.ORG_MEMBER_ADDED })
+    expect(mockAttachOwnedWorkspacesToOrganizationTx).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ ownerUserId: 'invitee-user', workspaceIds: ['joiner-ws-1'] })
     )
+    expect(mockReconcileOrganizationSeats).toHaveBeenCalled()
   })
 
-  it('does not reconcile seats for an Enterprise organization (fixed seats)', async () => {
+  it('attaches the invitee-owned personal workspaces when joining the organization', async () => {
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',
       name: 'Workspace',
@@ -648,7 +935,13 @@ describe('acceptInvitation', () => {
     mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
       success: true,
       organizationId: 'org-1',
-      fixedSeats: true,
+      fixedSeats: false,
+    })
+    mockAttachOwnedWorkspacesToOrganizationTx.mockResolvedValueOnce({
+      attachedWorkspaceIds: ['joiner-ws-1'],
+      addedMemberIds: [],
+      skippedMembers: [],
+      usageLimitUserIds: ['invitee-user'],
     })
 
     queueWhereResponses([
@@ -678,6 +971,10 @@ describe('acceptInvitation', () => {
       ],
       [{ name: 'Acme' }],
       [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [{ id: 'joiner-ws-1' }],
+      // Post-join owned-set re-check under the billing-identity lock.
+      [{ id: 'joiner-ws-1' }],
       // Grant-txn membership re-check under the lock: member still present.
       [{ id: 'member-1' }],
     ])
@@ -690,14 +987,30 @@ describe('acceptInvitation', () => {
     })
 
     expect(result.success).toBe(true)
-    expect(mockEnsureUserInOrganization).toHaveBeenCalledWith(
+    if (result.success) {
+      expect(result.redirectPath).toBe('/workspace/workspace-1/home')
+    }
+    expect(mockAttachOwnedWorkspacesToOrganizationTx).toHaveBeenCalledWith(
       expect.anything(),
-      expect.objectContaining({ organizationId: 'org-1', skipSeatValidation: false })
+      expect.objectContaining({
+        ownerUserId: 'invitee-user',
+        organizationId: 'org-1',
+        workspaceIds: ['joiner-ws-1'],
+        externalMemberPolicy: 'external-all',
+        ownerMatch: 'owner',
+        includeArchived: true,
+      })
     )
-    expect(mockReconcileOrganizationSeats).not.toHaveBeenCalled()
+    expect(mockSyncUsageLimitsFromSubscription).toHaveBeenCalledWith('invitee-user')
   })
 
-  it('does not run post-commit effects when the invitation transaction fails to commit', async () => {
+  it('surfaces the real cause, not a consent mismatch, when the disclosure said blocked', async () => {
+    /**
+     * The preview reports `blocked` for dead grants, so the screen promised
+     * nothing. Acceptance must return the real cause (`workspace-not-found`)
+     * rather than `disclosure-outdated` — the latter renders the same preview on
+     * retry, so the invitee would loop with no explanation.
+     */
     mockGetWorkspaceWithOwner.mockResolvedValue({
       id: 'workspace-1',
       name: 'Workspace',
@@ -706,28 +1019,11 @@ describe('acceptInvitation', () => {
       workspaceMode: 'organization',
       billedAccountUserId: 'owner-1',
     })
-    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
-      success: true,
-      organizationId: 'org-1',
-      fixedSeats: false,
-      postCommitEffects: {
-        planConversions: [
-          {
-            organizationId: 'org-1',
-            actorId: 'owner-1',
-            fromPlan: 'pro_6000',
-            toPlan: 'team_6000',
-          },
-        ],
-        usageLimitUserIds: ['collaborator-1'],
-      },
-    })
-
     queueWhereResponses([
       [
         {
           id: 'inv-1',
-          kind: 'workspace',
+          kind: 'organization',
           email: 'invitee@example.com',
           organizationId: 'org-1',
           membershipIntent: 'internal',
@@ -750,6 +1046,671 @@ describe('acceptInvitation', () => {
       ],
       [{ name: 'Acme' }],
       [{ name: 'Owner', email: 'owner@example.com' }],
+      [],
+      [],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      disclosedWorkspaceIds: [],
+      disclosedOutcome: 'blocked',
+    })
+
+    expect(result).toEqual({ success: false, kind: 'workspace-not-found' })
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+  })
+
+  it('rolls back a member-role org acceptance when every grant turned stale', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'organization',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
+      // Pre-join staleness gate: no grant workspace remains in the stamped org.
+      [],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+    })
+
+    expect(result).toEqual({ success: false, kind: 'workspace-not-found' })
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+    expect(auditMock.recordAudit).not.toHaveBeenCalled()
+  })
+
+  it('rejects a will-join disclosure when acceptance downgrades to external', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    // Invitee joined a different organization after the preview rendered.
+    mockGetUserOrganization.mockImplementation(async (userId: string) =>
+      userId === 'invitee-user'
+        ? { organizationId: 'org-2', role: 'member', memberId: 'member-2' }
+        : null
+    )
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [{ id: 'joiner-ws-1' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      // The accept screen promised a membership migration of joiner-ws-1.
+      disclosedWorkspaceIds: ['joiner-ws-1'],
+    })
+
+    expect(result).toEqual({ success: false, kind: 'disclosure-outdated' })
+    expect(dbChainMockFns.values).not.toHaveBeenCalled()
+    expect(auditMock.recordAudit).not.toHaveBeenCalled()
+  })
+
+  it('rolls back acceptance when the sweep set differs from the disclosed set', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
+      success: true,
+      organizationId: 'org-1',
+      fixedSeats: false,
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [{ id: 'joiner-ws-1' }],
+      // Post-join owned-set re-check under the billing-identity lock.
+      [{ id: 'joiner-ws-1' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      // The accept screen rendered before joiner-ws-1 existed.
+      disclosedWorkspaceIds: [],
+    })
+
+    expect(result).toEqual({ success: false, kind: 'disclosure-outdated' })
+    expect(mockAttachOwnedWorkspacesToOrganizationTx).not.toHaveBeenCalled()
+    expect(auditMock.recordAudit).not.toHaveBeenCalled()
+  })
+
+  it('rolls back acceptance when the owned-workspace set changes concurrently', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
+      success: true,
+      organizationId: 'org-1',
+      fixedSeats: false,
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [{ id: 'joiner-ws-1' }],
+      // Post-join re-check sees a workspace created after the lock plan.
+      [{ id: 'joiner-ws-1' }, { id: 'joiner-ws-2' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+    })
+
+    expect(result).toEqual({
+      success: false,
+      kind: 'server-error',
+      message: 'Your workspaces changed while accepting — please try again.',
+    })
+    expect(mockAttachOwnedWorkspacesToOrganizationTx).not.toHaveBeenCalled()
+    expect(auditMock.recordAudit).not.toHaveBeenCalled()
+  })
+
+  it('grants external access without joining when the workspace entered an org after the invite was sent', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'org-owner',
+    })
+    // Inviter is a plain member of org-1 (their own join attached this
+    // workspace), so the stale-stamped invite must not escalate to membership.
+    mockGetUserOrganization.mockImplementation(async (userId: string) =>
+      userId === 'inviter-1'
+        ? { organizationId: 'org-1', role: 'member', memberId: 'member-inviter' }
+        : null
+    )
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: null,
+          membershipIntent: 'internal',
+          inviterId: 'inviter-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Inviter', email: 'inviter@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
+      [],
+      [],
+      [{ variables: {} }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+    })
+
+    expect(result.success).toBe(true)
+    if (result.success) {
+      expect(result.invitation.membershipIntent).toBe('external')
+      expect(result.acceptedWorkspaceIds).toEqual(['workspace-1'])
+    }
+    expect(mockEnsureTeamOrganizationForAcceptance).not.toHaveBeenCalled()
+    expect(mockEnsureUserInOrganization).not.toHaveBeenCalled()
+    expect(mockAttachOwnedWorkspacesToOrganizationTx).not.toHaveBeenCalled()
+    expect(mockSetActiveOrganizationForCurrentSession).not.toHaveBeenCalled()
+  })
+
+  it('redirects organization invitations with grants into the first granted workspace', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
+      success: true,
+      organizationId: 'org-1',
+      fixedSeats: false,
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'organization',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
+      // Pre-join staleness gate: the granted workspace is still in the org.
+      [{ id: 'workspace-1' }],
+      // Post-join owned-set re-check under the billing-identity lock.
+      [],
+      // Grant-txn membership re-check under the lock: member still present.
+      [{ id: 'member-1' }],
+      // Invitation status update under the lock.
+      [],
+      // Live workspace organization for the org-invite grant staleness check.
+      [{ organizationId: 'org-1' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+    })
+
+    expect(result.success).toBe(true)
+    if (result.success) {
+      expect(result.redirectPath).toBe('/workspace/workspace-1/home')
+    }
+  })
+
+  it('does not record an ORG_MEMBER_ADDED audit for a user who is already a member', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    /**
+     * A genuinely pre-existing member: the membership is visible BEFORE
+     * acceptance runs. (An `alreadyMember` result with no prior membership
+     * means this transaction just auto-joined them, which must still sweep.)
+     */
+    mockGetUserOrganization.mockResolvedValue({
+      organizationId: 'org-1',
+      role: 'member',
+      memberId: 'member-1',
+    })
+    mockEnsureUserInOrganization.mockResolvedValueOnce({
+      success: true,
+      alreadyMember: true,
+      billingActions: { proUsageSnapshotted: false, proCancelledAtPeriodEnd: false },
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
+      [{ id: 'member-1' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+    })
+
+    expect(result.success).toBe(true)
+    if (result.success) {
+      expect(result.membershipAlreadyExists).toBe(true)
+    }
+    expect(auditMock.recordAudit).not.toHaveBeenCalledWith(
+      expect.objectContaining({ action: auditMock.AuditAction.ORG_MEMBER_ADDED })
+    )
+  })
+
+  it('lets a pre-existing member accept a no-join disclosure without looping', async () => {
+    /**
+     * The preview reports no-join for someone already in the target
+     * organization — nothing changes for them — while the invitation's intent
+     * stays internal, so `shouldJoinOrganization` remains true. Comparing the
+     * disclosure against that raw flag rejected every such acceptance as
+     * `disclosure-outdated`, and the retry re-rendered the same preview, so the
+     * invitation could never be accepted. The guard compares against whether a
+     * NEW membership is created instead.
+     */
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockGetUserOrganization.mockResolvedValue({
+      organizationId: 'org-1',
+      role: 'member',
+      memberId: 'member-1',
+    })
+    mockEnsureUserInOrganization.mockResolvedValueOnce({
+      success: true,
+      alreadyMember: true,
+      billingActions: { proUsageSnapshotted: false, proCancelledAtPeriodEnd: false },
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      [],
+      [{ id: 'member-1' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      disclosedWorkspaceIds: [],
+      disclosedOutcome: 'external' as const,
+    })
+
+    expect(result.success ? 'ok' : result.kind).toBe('ok')
+    if (result.success) {
+      expect(result.membershipAlreadyExists).toBe(true)
+    }
+  })
+
+  it('does not reconcile seats for an Enterprise organization (fixed seats)', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
+      success: true,
+      organizationId: 'org-1',
+      fixedSeats: true,
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
+      // Post-join owned-set re-check under the billing-identity lock.
+      [],
+      // Grant-txn membership re-check under the lock: member still present.
+      [{ id: 'member-1' }],
+    ])
+
+    const result = await acceptInvitation({
+      userId: 'invitee-user',
+      userEmail: 'invitee@example.com',
+      invitationId: 'inv-1',
+      token: 'tok-1',
+    })
+
+    expect(result.success).toBe(true)
+    expect(mockEnsureUserInOrganization).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ organizationId: 'org-1', skipSeatValidation: false })
+    )
+    expect(mockReconcileOrganizationSeats).not.toHaveBeenCalled()
+  })
+
+  it('does not run post-commit effects when the invitation transaction fails to commit', async () => {
+    mockGetWorkspaceWithOwner.mockResolvedValue({
+      id: 'workspace-1',
+      name: 'Workspace',
+      ownerId: 'owner-1',
+      organizationId: 'org-1',
+      workspaceMode: 'organization',
+      billedAccountUserId: 'owner-1',
+    })
+    mockEnsureTeamOrganizationForAcceptance.mockResolvedValueOnce({
+      success: true,
+      organizationId: 'org-1',
+      fixedSeats: false,
+      postCommitEffects: {
+        planConversions: [
+          {
+            organizationId: 'org-1',
+            actorId: 'owner-1',
+            fromPlan: 'pro_6000',
+            toPlan: 'team_6000',
+          },
+        ],
+        usageLimitUserIds: ['collaborator-1'],
+      },
+    })
+
+    queueWhereResponses([
+      [
+        {
+          id: 'inv-1',
+          kind: 'workspace',
+          email: 'invitee@example.com',
+          organizationId: 'org-1',
+          membershipIntent: 'internal',
+          inviterId: 'owner-1',
+          role: 'member',
+          status: 'pending',
+          token: 'tok-1',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ],
+      [
+        {
+          id: 'grant-1',
+          workspaceId: 'workspace-1',
+          permission: 'write',
+          workspaceName: 'Workspace',
+        },
+      ],
+      [{ name: 'Acme' }],
+      [{ name: 'Owner', email: 'owner@example.com' }],
+      // Invitee-owned personal workspaces for the acceptance lock plan.
+      [],
+      // Post-join owned-set re-check under the billing-identity lock.
+      [],
       [{ id: 'member-1' }],
     ])
 
diff --git a/apps/sim/lib/invitations/core.ts b/apps/sim/lib/invitations/core.ts
index 3e7bd38b196..f74b39a119e 100644
--- a/apps/sim/lib/invitations/core.ts
+++ b/apps/sim/lib/invitations/core.ts
@@ -14,12 +14,14 @@ import {
   workspaceEnvironment,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { PERMISSION_RANK, type PermissionType } from '@sim/platform-authz/workspace'
+import { isOrgAdminRole, PERMISSION_RANK, type PermissionType } from '@sim/platform-authz/workspace'
 import { generateId } from '@sim/utils/id'
 import { normalizeEmail } from '@sim/utils/string'
-import { and, eq, inArray, isNull, lte, ne, sql } from 'drizzle-orm'
+import { and, asc, count, eq, inArray, lte, sql } from 'drizzle-orm'
 import { setActiveOrganizationForCurrentSession } from '@/lib/auth/active-organization'
 import { applySessionPolicyToNewMember } from '@/lib/auth/session-policy'
+import { getOrganizationSubscription } from '@/lib/billing/core/billing'
+import { getHighestPriorityPersonalSubscription } from '@/lib/billing/core/plan'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import {
   acquireOrganizationMutationLock,
@@ -32,13 +34,19 @@ import {
   ensureTeamOrganizationForAcceptance,
 } from '@/lib/billing/organizations/provision-seat'
 import { reconcileOrganizationSeats } from '@/lib/billing/organizations/seats'
+import { isPro, isTeam } from '@/lib/billing/plan-helpers'
+import { hasUsableSubscriptionStatus } from '@/lib/billing/subscriptions/utils'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import type { DbOrTx } from '@/lib/db/types'
 import { acquireInvitationMutationLocks } from '@/lib/invitations/locks'
 import { captureServerEvent } from '@/lib/posthog/server'
+import {
+  attachOwnedWorkspacesToOrganizationTx,
+  ownedAttachableWorkspacesWhere,
+} from '@/lib/workspaces/organization-workspaces'
 import { getWorkspaceWithOwner, type WorkspaceWithOwner } from '@/lib/workspaces/permissions/utils'
-import { WORKSPACE_MODE } from '@/lib/workspaces/policy'
+import { getInvitePlanCategoryForUser } from '@/lib/workspaces/policy'
 
 const logger = createLogger('InvitationCore')
 
@@ -81,15 +89,6 @@ export async function getInvitationById(
   return hydrateInvitation(row, executor)
 }
 
-export async function getInvitationByToken(
-  token: string,
-  executor: DbOrTx = db
-): Promise<InvitationWithGrants | null> {
-  const [row] = await executor.select().from(invitation).where(eq(invitation.token, token)).limit(1)
-  if (!row) return null
-  return hydrateInvitation(row, executor)
-}
-
 async function hydrateInvitation(
   row: typeof invitation.$inferSelect,
   executor: DbOrTx = db
@@ -104,6 +103,12 @@ async function hydrateInvitation(
     .from(invitationWorkspaceGrant)
     .leftJoin(workspace, eq(workspace.id, invitationWorkspaceGrant.workspaceId))
     .where(eq(invitationWorkspaceGrant.invitationId, row.id))
+    /**
+     * Oldest grant first, so `grants[0]` — the primary grant that decides the
+     * join target and the billed account — stays the workspace the invitation
+     * was originally sent for even after later invites merge grants into it.
+     */
+    .orderBy(asc(invitationWorkspaceGrant.createdAt), asc(invitationWorkspaceGrant.id))
 
   let organizationName: string | null = null
   if (row.organizationId) {
@@ -150,6 +155,233 @@ export function isInvitationExpired(inv: Pick<InvitationWithGrants, 'expiresAt'>
   return new Date() > new Date(inv.expiresAt)
 }
 
+/**
+ * A workspace invitation only escalates into an EXISTING organization when
+ * that organization matches what was stamped at send time — a workspace that
+ * entered an organization after the invite went out (a member's owned
+ * workspaces attaching on join, an admin move) never asked that org for a
+ * seat, so escalation requires the inviter to currently hold admin standing
+ * there. A workspace with no current organization is deliberately exempt:
+ * acceptance trusts the live workspace over stale stamped metadata and falls
+ * back to the standard personal-workspace regime (Pro→Team conversion of the
+ * current billed account), matching long-standing tested behavior.
+ * Organization-kind invitations always join their STAMPED organization (the
+ * join target is never re-derived from a granted workspace, whose org can
+ * change after send), so they pass trivially here. Acceptance and the
+ * accept-screen preview both consume this predicate so the disclosure can
+ * never contradict the accepted outcome.
+ */
+async function stampedOrganizationAllowsEscalation(
+  inv: InvitationWithGrants,
+  workspaceOrganizationId: string | null,
+  executor: DbOrTx = db
+): Promise<boolean> {
+  if (inv.kind !== 'workspace') return true
+  if (!workspaceOrganizationId) return true
+  if (inv.organizationId === workspaceOrganizationId) return true
+  const inviterMembership = await getUserOrganization(inv.inviterId, executor)
+  return (
+    inviterMembership?.organizationId === workspaceOrganizationId &&
+    isOrgAdminRole(inviterMembership.role)
+  )
+}
+
+/**
+ * True when a member-role organization invitation still has at least one
+ * granted workspace inside the organization it was stamped with. All grants
+ * leaving that organization would strand the new member with nowhere to land,
+ * so acceptance refuses and the preview must predict the same — both consume
+ * this single predicate so they cannot drift.
+ */
+async function hasLiveGrantInStampedOrganization(
+  inv: InvitationWithGrants,
+  executor: DbOrTx = db
+): Promise<boolean> {
+  if (inv.kind !== 'organization' || !inv.organizationId) return true
+  if (isOrgAdminRole(inv.role)) return true
+  if (inv.grants.length === 0) return true
+  const [liveGrant] = await executor
+    .select({ id: workspace.id })
+    .from(workspace)
+    .where(
+      and(
+        inArray(
+          workspace.id,
+          inv.grants.map((grant) => grant.workspaceId)
+        ),
+        eq(workspace.organizationId, inv.organizationId)
+      )
+    )
+    .limit(1)
+  return Boolean(liveGrant)
+}
+
+/** @see InvitationJoinPreviewResult.outcome */
+export type InvitationJoinOutcome = 'will-join' | 'already-member' | 'external' | 'blocked'
+
+export interface InvitationJoinPreviewResult {
+  /**
+   * What accepting will actually do, as one value rather than a set of booleans.
+   *
+   * These four outcomes need genuinely different disclosure, and collapsing any
+   * of them loses something the invitee must know:
+   * - `will-join`     — a member row is created and a seat is taken.
+   * - `already-member` — they are in the organization already; only workspace
+   *   access changes, so neither the join nor the external copy is true.
+   * - `external`      — workspaces only, never a seat, nothing of theirs moves.
+   * - `blocked`       — acceptance will fail (`upgrade-required`,
+   *   `workspace-not-found`). Nothing is promised, because nothing happens.
+   */
+  outcome: InvitationJoinOutcome
+  /**
+   * Name of the organization acceptance will actually join. For a workspace
+   * invite this is the granted workspace's LIVE organization, which can differ
+   * from the stamped `invitation.organizationName` — the disclosure must name
+   * the organization that will really gain control of the user's workspaces.
+   */
+  organizationName: string | null
+  workspacesToMove: string[]
+  /**
+   * Stable ids behind `workspacesToMove`; the accept screen echoes them back
+   * as the disclosure token so acceptance can reject when the sweep set no
+   * longer matches what was disclosed.
+   */
+  workspaceIdsToMove: string[]
+}
+
+/**
+ * Best-effort preview of what accepting will do for the invitee: whether a
+ * member row will be created and which of their owned personal workspaces
+ * (archived included) will follow them into the organization. Mirrors the
+ * acceptance decision flow without taking locks — races resolve at accept
+ * time; the preview only feeds disclosure copy.
+ */
+export async function getInvitationJoinPreview(
+  inviteeUserId: string,
+  inv: InvitationWithGrants
+): Promise<InvitationJoinPreviewResult> {
+  const withOutcome = (outcome: InvitationJoinOutcome): InvitationJoinPreviewResult => ({
+    outcome,
+    organizationName: null,
+    workspacesToMove: [],
+    workspaceIdsToMove: [],
+  })
+
+  let workspaceOrganizationId = inv.organizationId
+  let billedAccountUserId: string | null = null
+  const primaryGrantWorkspaceId = inv.grants[0]?.workspaceId
+  if (primaryGrantWorkspaceId) {
+    const primaryWorkspace = await getWorkspaceWithOwner(primaryGrantWorkspaceId)
+    if (primaryWorkspace) {
+      billedAccountUserId = primaryWorkspace.billedAccountUserId
+      if (inv.kind === 'workspace') {
+        workspaceOrganizationId = primaryWorkspace.organizationId
+      }
+    }
+  }
+
+  /**
+   * Personal-workspace invites only produce an organization through billing's
+   * Pro→Team provisioning; with billing disabled there is nothing to join.
+   */
+  if (!workspaceOrganizationId && !isBillingEnabled) return withOutcome('external')
+
+  /**
+   * Already in the target organization (nothing changes) or in a different
+   * one (acceptance downgrades to external or rejects).
+   */
+  const existingMembership = await getUserOrganization(inviteeUserId)
+  const inDifferentOrganization =
+    !!existingMembership &&
+    (workspaceOrganizationId ? existingMembership.organizationId !== workspaceOrganizationId : true)
+
+  if (inv.membershipIntent === 'external') {
+    /**
+     * Mirrors acceptance's `external-requires-paid-plan` gate, including its
+     * exemptions: it only applies with billing on, to an organization-owned
+     * workspace, and not when externality was imposed because the invitee already
+     * belongs to another organization. Without this the screen promised external
+     * access that acceptance would refuse.
+     */
+    if (
+      isBillingEnabled &&
+      !inDifferentOrganization &&
+      workspaceOrganizationId &&
+      (await getInvitePlanCategoryForUser(inviteeUserId)) === 'free'
+    ) {
+      return withOutcome('blocked')
+    }
+    return withOutcome('external')
+  }
+
+  if (existingMembership) {
+    /**
+     * Already in the organization acceptance lands in: nothing about their
+     * standing changes. A membership in a DIFFERENT organization is the
+     * external case — acceptance downgrades — so it keeps the plain shape.
+     */
+    if (!inDifferentOrganization) return withOutcome('already-member')
+    /**
+     * In a DIFFERENT organization. Acceptance only downgrades a workspace-kind
+     * invite with live grants to external; an organization-kind invite (or one
+     * with no grants) hard-fails with `already-in-organization`, so promising
+     * external access there would be a disclosure the accept can never honour.
+     */
+    return withOutcome(inv.kind === 'workspace' && inv.grants.length > 0 ? 'external' : 'blocked')
+  }
+
+  if (!(await stampedOrganizationAllowsEscalation(inv, workspaceOrganizationId)))
+    return withOutcome('external')
+
+  if (!(await hasLiveGrantInStampedOrganization(inv))) return withOutcome('blocked')
+
+  /**
+   * Mirror acceptance's billing gates: an unusable organization subscription
+   * (or, for personal-workspace invites, a billed owner without a convertible
+   * paid plan) makes acceptance fail with upgrade-required — the disclosure
+   * must not promise a migration that cannot happen.
+   */
+  if (isBillingEnabled) {
+    if (workspaceOrganizationId) {
+      const orgSub = await getOrganizationSubscription(workspaceOrganizationId)
+      if (!orgSub || !hasUsableSubscriptionStatus(orgSub.status)) return withOutcome('blocked')
+    } else {
+      const payerUserId = billedAccountUserId ?? inv.inviterId
+      const personalSub = await getHighestPriorityPersonalSubscription(payerUserId)
+      if (
+        !personalSub ||
+        !hasUsableSubscriptionStatus(personalSub.status) ||
+        !(isPro(personalSub.plan) || isTeam(personalSub.plan))
+      ) {
+        return withOutcome('blocked')
+      }
+    }
+  }
+
+  const ownedWorkspaces = await db
+    .select({ id: workspace.id, name: workspace.name })
+    .from(workspace)
+    .where(ownedAttachableWorkspacesWhere({ userId: inviteeUserId, includeArchived: true }))
+    .orderBy(asc(workspace.name))
+
+  let targetOrganizationName: string | null = null
+  if (workspaceOrganizationId) {
+    const [targetOrg] = await db
+      .select({ name: organization.name })
+      .from(organization)
+      .where(eq(organization.id, workspaceOrganizationId))
+      .limit(1)
+    targetOrganizationName = targetOrg?.name ?? null
+  }
+
+  return {
+    outcome: 'will-join',
+    organizationName: targetOrganizationName,
+    workspacesToMove: ownedWorkspaces.map((row) => row.name),
+    workspaceIdsToMove: ownedWorkspaces.map((row) => row.id),
+  }
+}
+
 /**
  * Flip any still-pending invitations for the given organization whose
  * `expiresAt` has already passed to `expired`. Best-effort housekeeping
@@ -178,48 +410,10 @@ export async function expireStalePendingInvitationsForOrganization(
   }
 }
 
-/**
- * Flip any still-pending invitations with grants on the given workspaces
- * whose `expiresAt` has already passed to `expired`.
- */
-export async function expireStalePendingInvitationsForWorkspaces(
-  workspaceIds: string[]
-): Promise<void> {
-  if (workspaceIds.length === 0) return
-  try {
-    const staleIds = await db
-      .select({ id: invitation.id })
-      .from(invitation)
-      .innerJoin(invitationWorkspaceGrant, eq(invitationWorkspaceGrant.invitationId, invitation.id))
-      .where(
-        and(
-          inArray(invitationWorkspaceGrant.workspaceId, workspaceIds),
-          eq(invitation.status, 'pending'),
-          lte(invitation.expiresAt, new Date())
-        )
-      )
-
-    if (staleIds.length === 0) return
-
-    await db
-      .update(invitation)
-      .set({ status: 'expired', updatedAt: new Date() })
-      .where(
-        inArray(
-          invitation.id,
-          staleIds.map((row) => row.id)
-        )
-      )
-  } catch (error) {
-    logger.error('Failed to expire stale pending invitations for workspaces', {
-      workspaceCount: workspaceIds.length,
-      error,
-    })
-  }
-}
-
 export type AcceptInvitationFailure =
   | { kind: 'not-found' }
+  | { kind: 'workspace-not-found' }
+  | { kind: 'disclosure-outdated' }
   | { kind: 'already-processed' }
   | { kind: 'expired' }
   | { kind: 'email-mismatch' }
@@ -227,6 +421,7 @@ export type AcceptInvitationFailure =
   | { kind: 'already-in-organization' }
   | { kind: 'no-seats-available' }
   | { kind: 'upgrade-required' }
+  | { kind: 'external-requires-paid-plan' }
   | { kind: 'server-error'; message?: string }
 
 export type AcceptInvitationSuccess = {
@@ -247,6 +442,18 @@ export interface AcceptInvitationInput {
   actorName?: string | null
   invitationId: string
   token: string | null
+  /**
+   * Workspace ids the accept screen disclosed as moving. When provided,
+   * acceptance fails with `disclosure-outdated` if the set it would sweep
+   * differs — the user must see the refreshed notice before consenting.
+   */
+  disclosedWorkspaceIds?: string[]
+  /**
+   * The outcome the accept screen disclosed. Verified against the resolved
+   * outcome so a membership the user was never shown can never be created, and
+   * a membership they were promised can never be silently downgraded.
+   */
+  disclosedOutcome?: InvitationJoinOutcome
   request?: { headers: { get(name: string): string | null } }
 }
 
@@ -263,55 +470,124 @@ class MembershipRevokedDuringAcceptError extends Error {
   }
 }
 
+/**
+ * Thrown after the member insert when the invitee's owned-workspace set no
+ * longer matches the pre-lock plan (a workspace was created concurrently and
+ * would escape the sweep). Rolls the whole acceptance back; safe to retry.
+ */
+class JoinerWorkspacesChangedDuringAcceptError extends Error {
+  constructor() {
+    super('Owned workspaces changed during invite acceptance')
+    this.name = 'JoinerWorkspacesChangedDuringAcceptError'
+  }
+}
+
+/**
+ * Thrown when every grant on a member-role organization invite turned stale
+ * (the workspaces left the stamped organization), which would strand the new
+ * member with no workspace. Rolls the whole acceptance back.
+ */
+class AllGrantsStaleDuringAcceptError extends Error {
+  constructor() {
+    super('All organization-invite grants turned stale during acceptance')
+    this.name = 'AllGrantsStaleDuringAcceptError'
+  }
+}
+
+/**
+ * Thrown when the workspace set acceptance would sweep no longer matches the
+ * set the accept screen disclosed. Rolls the acceptance back so the user
+ * consents to the refreshed notice instead of a silent migration.
+ */
+class DisclosureOutdatedDuringAcceptError extends Error {
+  constructor() {
+    super('Disclosed workspace set no longer matches the sweep set')
+    this.name = 'DisclosureOutdatedDuringAcceptError'
+  }
+}
+
 interface InvitationAcceptancePostCommitEffects {
   organizationId: string | null
   memberRole: string | null
   reconcileSeats: boolean
   acceptedWorkspaceIds: string[]
+  /** Owned personal workspaces that followed the invitee into the org. */
+  attachedWorkspaceIds: string[]
   syncUsageLimitUserIds: string[]
   planConversions: AcceptancePlanConversion[]
   acceptedInvitation: InvitationWithGrants | null
   membershipAlreadyExists: boolean
 }
 
-/**
- * Compute the complete workspace lock set before taking any workspace lock.
- * A personal Pro→Team conversion attaches the billing owner's other personal
- * workspaces in the same transaction, so those rows must participate in the
- * same deterministic lock ordering as the invitation grants.
- */
+interface InvitationAcceptanceLockPlan {
+  /**
+   * Invitation grant workspaces plus the billing owner's attachable
+   * workspaces (a personal Pro→Team conversion attaches those in the same
+   * transaction). Passed through to acceptance provisioning unchanged.
+   */
+  workspaceIds: string[]
+  /**
+   * Workspaces the invitee owns outside any organization. When acceptance
+   * joins them into an organization, these rows attach in the same
+   * transaction, so they participate in the same deterministic lock ordering.
+   */
+  joinerAttachWorkspaceIds: string[]
+  primaryWorkspace: WorkspaceWithOwner | null
+}
+
+/** Compute the complete workspace lock set before taking any workspace lock. */
 async function getInvitationAcceptanceWorkspaceLockIds(
   tx: DbOrTx,
-  inv: InvitationWithGrants
-): Promise<{ workspaceIds: string[]; primaryWorkspace: WorkspaceWithOwner | null }> {
+  inv: InvitationWithGrants,
+  inviteeUserId: string
+): Promise<InvitationAcceptanceLockPlan> {
   const grantWorkspaceIds = inv.grants.map((grant) => grant.workspaceId)
   const primaryWorkspace = grantWorkspaceIds[0]
     ? await getWorkspaceWithOwner(grantWorkspaceIds[0], { executor: tx })
     : null
-  if (
-    !isBillingEnabled ||
-    inv.membershipIntent === 'external' ||
-    !primaryWorkspace ||
-    primaryWorkspace.organizationId
-  ) {
-    return { workspaceIds: [...new Set(grantWorkspaceIds)].sort(), primaryWorkspace }
-  }
 
-  const attachableWorkspaces = await tx
-    .select({ id: workspace.id })
-    .from(workspace)
-    .where(
-      and(
-        eq(workspace.billedAccountUserId, primaryWorkspace.billedAccountUserId),
-        isNull(workspace.organizationId),
-        ne(workspace.workspaceMode, WORKSPACE_MODE.ORGANIZATION)
-      )
-    )
+  /**
+   * Computed for every non-external invite. The post-lock workspace re-read
+   * can reveal an organization this pre-lock snapshot does not have (a
+   * concurrent attach or move), and the join-attach sweep must already hold
+   * these locks in that case — so no billing/organization short-circuit is
+   * safe here. Only external intent (immutable: it is never upgraded
+   * in-flight) provably rules a join out.
+   */
+  const joinerAttachWorkspaceIds =
+    inv.membershipIntent === 'external'
+      ? []
+      : (
+          await tx
+            .select({ id: workspace.id })
+            .from(workspace)
+            .where(ownedAttachableWorkspacesWhere({ userId: inviteeUserId, includeArchived: true }))
+        ).map((row) => row.id)
+
+  const billingOwnerCanAttach =
+    isBillingEnabled &&
+    inv.membershipIntent !== 'external' &&
+    primaryWorkspace !== null &&
+    !primaryWorkspace.organizationId
+
+  const billingOwnerWorkspaceIds = billingOwnerCanAttach
+    ? (
+        await tx
+          .select({ id: workspace.id })
+          .from(workspace)
+          .where(
+            ownedAttachableWorkspacesWhere({
+              userId: primaryWorkspace.billedAccountUserId,
+              ownerMatch: 'billing-account',
+              includeArchived: true,
+            })
+          )
+      ).map((row) => row.id)
+    : []
 
   return {
-    workspaceIds: [
-      ...new Set([...grantWorkspaceIds, ...attachableWorkspaces.map((row) => row.id)]),
-    ].sort(),
+    workspaceIds: [...new Set([...grantWorkspaceIds, ...billingOwnerWorkspaceIds])].sort(),
+    joinerAttachWorkspaceIds: [...new Set(joinerAttachWorkspaceIds)].sort(),
     primaryWorkspace,
   }
 }
@@ -324,49 +600,104 @@ export async function acceptInvitation(
     memberRole: null,
     reconcileSeats: false,
     acceptedWorkspaceIds: [],
+    attachedWorkspaceIds: [],
     syncUsageLimitUserIds: [],
     planConversions: [],
     acceptedInvitation: null,
     membershipAlreadyExists: false,
   }
-  const result = await db.transaction(async (tx): Promise<AcceptInvitationResult> => {
-    await acquireInvitationMutationLocks(tx, {
-      invitationIds: [input.invitationId],
-      workspaceIds: [],
-    })
+  const result = await db
+    .transaction(async (tx): Promise<AcceptInvitationResult> => {
+      await acquireInvitationMutationLocks(tx, {
+        invitationIds: [input.invitationId],
+        workspaceIds: [],
+      })
 
-    await tx.execute(sql`select id from invitation where id = ${input.invitationId} for update`)
+      await tx.execute(sql`select id from invitation where id = ${input.invitationId} for update`)
 
-    const inv = await getInvitationById(input.invitationId, tx)
-    if (!inv) {
-      return { success: false, kind: 'not-found' }
-    }
+      const inv = await getInvitationById(input.invitationId, tx)
+      if (!inv) {
+        return { success: false, kind: 'not-found' }
+      }
 
-    const lockPlan = await getInvitationAcceptanceWorkspaceLockIds(tx, inv)
-    await acquireInvitationMutationLocks(tx, {
-      invitationIds: [],
-      workspaceIds: lockPlan.workspaceIds,
-    })
+      /**
+       * Cheap validity checks run before the workspace lock plan so replayed,
+       * expired, or mismatched accepts pay no workspace queries or advisory
+       * locks. The invitation row is already advisory- and row-locked above,
+       * so these reads cannot race a concurrent acceptance.
+       */
+      if (input.token && inv.token !== input.token) {
+        return { success: false, kind: 'invalid-token' }
+      }
+      if (inv.status !== 'pending') {
+        return { success: false, kind: 'already-processed' }
+      }
+      if (isInvitationExpired(inv)) {
+        await tx
+          .update(invitation)
+          .set({ status: 'expired', updatedAt: new Date() })
+          .where(and(eq(invitation.id, inv.id), eq(invitation.status, 'pending')))
+        return { success: false, kind: 'expired' }
+      }
+      if (normalizeEmail(input.userEmail) !== normalizeEmail(inv.email)) {
+        return { success: false, kind: 'email-mismatch' }
+      }
 
-    // Re-read and row-lock the primary workspace only after the shared
-    // workspace advisory lock is held. If a move won the lock first, every
-    // billing and membership decision below now uses the committed post-move
-    // organization/billing identity rather than the pre-lock snapshot.
-    const lockedPrimaryWorkspace = inv.grants[0]
-      ? await getWorkspaceWithOwner(inv.grants[0].workspaceId, {
-          executor: tx,
-          forUpdate: true,
+      const lockPlan = await getInvitationAcceptanceWorkspaceLockIds(tx, inv, input.userId)
+      await acquireInvitationMutationLocks(tx, {
+        invitationIds: [],
+        workspaceIds: [
+          ...new Set([...lockPlan.workspaceIds, ...lockPlan.joinerAttachWorkspaceIds]),
+        ],
+      })
+
+      // Re-read and row-lock the primary workspace only after the shared
+      // workspace advisory lock is held. If a move won the lock first, every
+      // billing and membership decision below now uses the committed post-move
+      // organization/billing identity rather than the pre-lock snapshot.
+      const lockedPrimaryWorkspace = inv.grants[0]
+        ? await getWorkspaceWithOwner(inv.grants[0].workspaceId, {
+            executor: tx,
+            forUpdate: true,
+          })
+        : null
+
+      return acceptLockedInvitation(
+        input,
+        inv,
+        { ...lockPlan, primaryWorkspace: lockedPrimaryWorkspace },
+        tx,
+        effects
+      )
+    })
+    .catch((error): AcceptInvitationResult => {
+      if (error instanceof JoinerWorkspacesChangedDuringAcceptError) {
+        logger.warn('Invite acceptance rolled back: owned workspaces changed concurrently', {
+          invitationId: input.invitationId,
+          userId: input.userId,
         })
-      : null
-
-    return acceptLockedInvitation(
-      input,
-      inv,
-      { ...lockPlan, primaryWorkspace: lockedPrimaryWorkspace },
-      tx,
-      effects
-    )
-  })
+        return {
+          success: false,
+          kind: 'server-error',
+          message: 'Your workspaces changed while accepting — please try again.',
+        }
+      }
+      if (error instanceof AllGrantsStaleDuringAcceptError) {
+        logger.warn('Invite acceptance rolled back: every grant turned stale', {
+          invitationId: input.invitationId,
+          userId: input.userId,
+        })
+        return { success: false, kind: 'workspace-not-found' }
+      }
+      if (error instanceof DisclosureOutdatedDuringAcceptError) {
+        logger.warn('Invite acceptance rolled back: disclosed workspace set is outdated', {
+          invitationId: input.invitationId,
+          userId: input.userId,
+        })
+        return { success: false, kind: 'disclosure-outdated' }
+      }
+      throw error
+    })
   if (result.success) {
     await runInvitationAcceptancePostCommitEffects(input, effects)
   }
@@ -376,42 +707,37 @@ export async function acceptInvitation(
 async function acceptLockedInvitation(
   input: AcceptInvitationInput,
   inv: InvitationWithGrants,
-  lockPlan: { workspaceIds: string[]; primaryWorkspace: WorkspaceWithOwner | null },
+  lockPlan: InvitationAcceptanceLockPlan,
   tx: DbOrTx,
   effects: InvitationAcceptancePostCommitEffects
 ): Promise<AcceptInvitationResult> {
-  if (input.token && inv.token !== input.token) {
-    return { success: false, kind: 'invalid-token' }
-  }
-
-  if (inv.status !== 'pending') {
-    return { success: false, kind: 'already-processed' }
-  }
-
-  if (isInvitationExpired(inv)) {
-    await tx
-      .update(invitation)
-      .set({ status: 'expired', updatedAt: new Date() })
-      .where(and(eq(invitation.id, inv.id), eq(invitation.status, 'pending')))
-    return { success: false, kind: 'expired' }
-  }
-
-  if (normalizeEmail(input.userEmail) !== normalizeEmail(inv.email)) {
-    return { success: false, kind: 'email-mismatch' }
-  }
-
   let membershipAlreadyExists = false
   let acceptedMembershipIntent = inv.membershipIntent
   let shouldJoinOrganization = inv.membershipIntent !== 'external'
 
+  /**
+   * Workspace-kind invites derive their join target from the granted
+   * workspace's LIVE organization (the workspace is what was shared).
+   * Organization-kind invites always target their STAMPED organization: a
+   * granted workspace whose org changed after send must never redirect the
+   * membership into an organization the invitee was not invited to.
+   */
   const primaryGrant = inv.grants[0]
   let billingOwnerUserId = inv.inviterId
   let workspaceOrganizationId = inv.organizationId
-  if (primaryGrant && lockPlan.primaryWorkspace) {
+  if (primaryGrant && lockPlan.primaryWorkspace && inv.kind === 'workspace') {
     billingOwnerUserId = lockPlan.primaryWorkspace.billedAccountUserId
     workspaceOrganizationId = lockPlan.primaryWorkspace.organizationId
   }
 
+  if (
+    shouldJoinOrganization &&
+    !(await stampedOrganizationAllowsEscalation(inv, workspaceOrganizationId, tx))
+  ) {
+    acceptedMembershipIntent = 'external'
+    shouldJoinOrganization = false
+  }
+
   const existingMembership = await getUserOrganization(input.userId, tx)
   const inviteeAlreadyInDifferentOrg =
     !!existingMembership &&
@@ -425,13 +751,102 @@ async function acceptLockedInvitation(
     shouldJoinOrganization = false
   }
 
+  /**
+   * External collaborators hold access inside a paid organization without
+   * taking one of its seats, so the invitee has to be paying Sim elsewhere.
+   * The invite-time gate can go stale across the invitation's 7-day life (a
+   * cancelled Pro), so the same predicate runs again here.
+   *
+   * Mirrors exactly when the invite-time gate applies, which is narrower than
+   * "the invitation is external". Externality is imposed, not chosen, whenever
+   * the invitee already belongs to another organization — an account can only
+   * be in one, so the inviter's Member/Admin choice is overridden and
+   * `inviteeCanBeExternal` never runs. The same holds for the downgrades above,
+   * where a workspace moved organizations after the invite went out. Those
+   * fallbacks preserve access the invitee was already legitimately granted;
+   * charging them a plan requirement nobody warned the inviter about would
+   * strand them over someone else's action. Scoped to organization-owned
+   * workspaces because sharing a personal workspace has no seat economics.
+   */
+  if (
+    isBillingEnabled &&
+    inv.membershipIntent === 'external' &&
+    !inviteeAlreadyInDifferentOrg &&
+    workspaceOrganizationId &&
+    (await getInvitePlanCategoryForUser(input.userId, tx)) === 'free'
+  ) {
+    return { success: false, kind: 'external-requires-paid-plan' }
+  }
+
+  /**
+   * Already in the organization the invitation lands in, so acceptance grants
+   * the workspaces without creating a membership or taking a seat. Shared with
+   * the consent guard and the join block below so they cannot disagree about
+   * whether this acceptance creates a member.
+   */
+  const alreadyMemberOfTargetOrganization =
+    !!existingMembership &&
+    !!workspaceOrganizationId &&
+    existingMembership.organizationId === workspaceOrganizationId
+
+  /**
+   * A member-role organization invite whose grants ALL left the stamped
+   * organization can never land its member anywhere — fail before any
+   * mutation. This must precede the disclosure check: the preview mirrors
+   * this gate with an empty disclosure, and rejecting on disclosure first
+   * would loop the client on disclosure-outdated instead of surfacing the
+   * real cause. The grant rows are advisory-locked, so this read cannot
+   * change for the rest of the transaction.
+   */
+  if (shouldJoinOrganization && !(await hasLiveGrantInStampedOrganization(inv, tx))) {
+    return { success: false, kind: 'workspace-not-found' }
+  }
+
+  /**
+   * Membership consent guard. The workspace-id token cannot distinguish "you
+   * will join, and nothing of yours moves" from "you will not join at all" —
+   * both disclose an empty set — so the disclosed outcome is compared directly.
+   *
+   * Compared against whether a NEW membership gets created, not against
+   * `shouldJoinOrganization`: the preview reports `already-member` for an
+   * invitee who already belongs to the target organization (nothing changes for
+   * them) while the invitation's intent is still internal, and comparing the raw
+   * flag would reject every such acceptance as `disclosure-outdated` with a
+   * retry that renders the same preview.
+   *
+   * A disclosed `blocked` is skipped deliberately: the screen already told the
+   * invitee acceptance would fail, so the gates below must surface the real
+   * cause (`upgrade-required`, `workspace-not-found`) instead of a consent
+   * mismatch. Placed after the dead-grant gate for the same reason.
+   *
+   * Runs before any write, so a plain failure return needs no rollback.
+   */
+  /**
+   * Whether acceptance will actually create a member row, decided from the same
+   * conditions the join block below uses — `shouldJoinOrganization` alone is not
+   * enough here, because it is only cleared much later (after provisioning fails
+   * to yield a target organization), by which point a write has happened.
+   *
+   * The last term mirrors the preview: with no organization on the workspace and
+   * billing disabled there is nothing to provision and nothing to join, so a
+   * personal or grandfathered workspace invite creates no membership. Omitting it
+   * rejected every such acceptance as `disclosure-outdated` on billing-disabled
+   * deployments, with a retry that rendered the same preview.
+   */
+  const willCreateMembership =
+    shouldJoinOrganization &&
+    !alreadyMemberOfTargetOrganization &&
+    (!!workspaceOrganizationId || isBillingEnabled)
+  if (input.disclosedOutcome !== undefined && input.disclosedOutcome !== 'blocked') {
+    if ((input.disclosedOutcome === 'will-join') !== willCreateMembership) {
+      return { success: false, kind: 'disclosure-outdated' }
+    }
+  }
+
   let targetOrganizationId = workspaceOrganizationId
 
   if (shouldJoinOrganization) {
-    const alreadyMemberOfTarget =
-      !!existingMembership &&
-      !!workspaceOrganizationId &&
-      existingMembership.organizationId === workspaceOrganizationId
+    const alreadyMemberOfTarget = alreadyMemberOfTargetOrganization
 
     let fixedSeats = false
 
@@ -486,23 +901,128 @@ async function acceptLockedInvitation(
       }
       membershipAlreadyExists = membershipResult.alreadyMember
 
-      if (!membershipResult.alreadyMember) {
+      /**
+       * `membershipResult.alreadyMember` is true both for a genuinely
+       * pre-existing member AND for an invitee this very transaction just
+       * auto-joined (the Pro→Team conversion's `keep-external` attach joins
+       * org-less collaborators of the billing owner's workspaces before we
+       * reach here). Only the FORMER may skip the join side effects, so key
+       * them off the pre-acceptance membership snapshot instead — otherwise a
+       * collaborator-invitee silently keeps their workspaces personal, pays
+       * no seat, and loses their invited role.
+       */
+      const joinedDuringThisAcceptance = !alreadyMemberOfTarget
+
+      if (joinedDuringThisAcceptance) {
         effects.memberRole = inv.role || 'member'
       }
 
+      /**
+       * An in-transaction auto-join lands everyone as `member`; restore the
+       * role the invitation actually granted when it is higher.
+       */
+      if (
+        joinedDuringThisAcceptance &&
+        membershipResult.alreadyMember &&
+        isOrgAdminRole(inv.role)
+      ) {
+        await tx
+          .update(member)
+          .set({ role: inv.role })
+          .where(
+            and(eq(member.userId, input.userId), eq(member.organizationId, targetOrganizationId))
+          )
+      }
+
       // Grow the paid seat count to match the new member and push the charge
       // to Stripe asynchronously (Team plans only; Enterprise seats are
       // fixed). Best-effort: the member is already in, and a transient
       // failure self-heals on the next join/removal reconcile, matching the
       // removal path's seat accounting.
-      if (billingManagesSeats && !membershipResult.alreadyMember) {
+      if (billingManagesSeats && joinedDuringThisAcceptance) {
         effects.reconcileSeats = true
       }
+
+      /**
+       * A new member's owned personal workspaces follow them into the
+       * organization so members never operate outside the org's purview.
+       * Collaborators on those workspaces stay external (`external-all`) —
+       * membership and seats never grow as a side effect of someone else's
+       * join. Fresh joins only: pre-existing members' estates are left
+       * untouched until an announced backfill.
+       *
+       * ensureUserInOrganizationTx holds the user's billing-identity lock,
+       * which personal workspace creation also takes — so the owned set is
+       * re-read here race-free. A set that changed since the pre-lock plan
+       * means a workspace escaped the advisory locks: the acceptance is
+       * rolled back (retry succeeds with the fresh set) instead of committing
+       * a member whose workspace dodged the sweep.
+       */
+      if (joinedDuringThisAcceptance) {
+        const currentOwnedIds = (
+          await tx
+            .select({ id: workspace.id })
+            .from(workspace)
+            .where(ownedAttachableWorkspacesWhere({ userId: input.userId, includeArchived: true }))
+        ).map((row) => row.id)
+        if (
+          [...currentOwnedIds].sort().join() !==
+          [...lockPlan.joinerAttachWorkspaceIds].sort().join()
+        ) {
+          throw new JoinerWorkspacesChangedDuringAcceptError()
+        }
+
+        /**
+         * Consent is only valid for the workspace set the user saw: when the
+         * client supplies the disclosed ids from the join preview, a sweep
+         * set that differs (a workspace created or removed since the preview
+         * rendered) rolls the acceptance back so the refreshed notice is
+         * shown before any migration happens.
+         */
+        if (
+          input.disclosedWorkspaceIds !== undefined &&
+          [...input.disclosedWorkspaceIds].sort().join() !==
+            [...lockPlan.joinerAttachWorkspaceIds].sort().join()
+        ) {
+          throw new DisclosureOutdatedDuringAcceptError()
+        }
+
+        if (lockPlan.joinerAttachWorkspaceIds.length > 0) {
+          // No acquireOrganizationMutationLock here: ensureUserInOrganizationTx
+          // above already took it for this organization, and advisory locks are
+          // transaction-scoped, so re-taking it is two wasted round trips.
+          const attachResult = await attachOwnedWorkspacesToOrganizationTx(tx, {
+            ownerUserId: input.userId,
+            organizationId: targetOrganizationId,
+            workspaceIds: lockPlan.joinerAttachWorkspaceIds,
+            externalMemberPolicy: 'external-all',
+            ownerMatch: 'owner',
+            includeArchived: true,
+          })
+          effects.syncUsageLimitUserIds.push(...attachResult.usageLimitUserIds)
+          effects.attachedWorkspaceIds = attachResult.attachedWorkspaceIds
+        }
+      }
     } else {
       shouldJoinOrganization = false
     }
   }
 
+  /**
+   * Reverse disclosure guard: a will-join notice (non-empty disclosed set)
+   * whose acceptance resolved to no-join must not silently succeed as an
+   * external grant — the user consented to membership plus a migration that
+   * will not happen. Nothing has been written on the no-join path, so a
+   * plain failure return suffices; retry renders the refreshed preview.
+   */
+  if (
+    !shouldJoinOrganization &&
+    input.disclosedWorkspaceIds !== undefined &&
+    input.disclosedWorkspaceIds.length > 0
+  ) {
+    return { success: false, kind: 'disclosure-outdated' }
+  }
+
   const acceptedWorkspaceIds: string[] = []
 
   try {
@@ -534,6 +1054,28 @@ async function acceptLockedInvitation(
       .where(and(eq(invitation.id, inv.id), eq(invitation.status, 'pending')))
 
     for (const grant of inv.grants) {
+      /**
+       * Organization-invite grants are only honored while the workspace still
+       * belongs to the stamped organization: a workspace that detached or
+       * moved after the invite went out is no longer the org's to share.
+       */
+      if (inv.kind === 'organization' && inv.organizationId) {
+        const [grantWorkspace] = await tx
+          .select({ organizationId: workspace.organizationId })
+          .from(workspace)
+          .where(eq(workspace.id, grant.workspaceId))
+          .limit(1)
+        if (!grantWorkspace || grantWorkspace.organizationId !== inv.organizationId) {
+          logger.warn('Skipping stale organization-invite grant; workspace left the organization', {
+            invitationId: inv.id,
+            workspaceId: grant.workspaceId,
+            stampedOrganizationId: inv.organizationId,
+            currentOrganizationId: grantWorkspace?.organizationId ?? null,
+          })
+          continue
+        }
+      }
+
       const [existingPermission] = await tx
         .select({ id: permissions.id, permissionType: permissions.permissionType })
         .from(permissions)
@@ -572,6 +1114,24 @@ async function acceptLockedInvitation(
 
       acceptedWorkspaceIds.push(grant.workspaceId)
     }
+
+    /**
+     * A member-role organization invite whose grants ALL turned stale would
+     * create a member with no workspace to land in — the exact dead end the
+     * invite-time grant requirement exists to prevent. Roll the whole
+     * acceptance (including the member insert) back instead; admins are
+     * exempt since they derive access to every organization workspace.
+     */
+    if (
+      inv.kind === 'organization' &&
+      shouldJoinOrganization &&
+      !membershipAlreadyExists &&
+      !isOrgAdminRole(inv.role) &&
+      inv.grants.length > 0 &&
+      acceptedWorkspaceIds.length === 0
+    ) {
+      throw new AllGrantsStaleDuringAcceptError()
+    }
   } catch (grantError) {
     if (grantError instanceof MembershipRevokedDuringAcceptError) {
       logger.warn('Aborted invite acceptance: org membership revoked concurrently', {
@@ -599,9 +1159,7 @@ async function acceptLockedInvitation(
   effects.membershipAlreadyExists = membershipAlreadyExists
 
   const redirectPath =
-    inv.kind === 'workspace' && acceptedWorkspaceIds.length > 0
-      ? `/workspace/${acceptedWorkspaceIds[0]}/home`
-      : '/workspace'
+    acceptedWorkspaceIds.length > 0 ? `/workspace/${acceptedWorkspaceIds[0]}/home` : '/workspace'
 
   return {
     success: true,
@@ -658,7 +1216,11 @@ async function runInvitationAcceptancePostCommitEffects(
       resourceType: AuditResourceType.ORGANIZATION,
       resourceId: effects.organizationId,
       description: `Joined organization as ${effects.memberRole} via invite acceptance`,
-      metadata: { invitationId: input.invitationId, memberRole: effects.memberRole },
+      metadata: {
+        invitationId: input.invitationId,
+        memberRole: effects.memberRole,
+        attachedWorkspaceIds: effects.attachedWorkspaceIds,
+      },
     })
     captureServerEvent(
       input.userId,
@@ -799,6 +1361,64 @@ export async function cancelInvitation(invitationId: string): Promise<boolean> {
   return result.length > 0
 }
 
+/**
+ * Revokes one workspace's grant from a pending invitation, cancelling the whole
+ * invitation only when that was its last grant.
+ *
+ * One invitation can span several workspaces, so revoking from a single
+ * workspace's member list must not destroy the grants to its siblings — an
+ * admin of one workspace has no authority over the others. Removing the final
+ * grant would otherwise strand a pending invitation that grants nothing, so
+ * that case cancels it instead.
+ */
+export async function revokeInvitationWorkspaceGrant({
+  invitationId,
+  workspaceId,
+}: {
+  invitationId: string
+  workspaceId: string
+}): Promise<{ revoked: boolean; invitationCancelled: boolean }> {
+  return db.transaction(async (tx) => {
+    const [pending] = await tx
+      .select({ id: invitation.id })
+      .from(invitation)
+      .where(and(eq(invitation.id, invitationId), eq(invitation.status, 'pending')))
+      .for('update')
+      .limit(1)
+    if (!pending) return { revoked: false, invitationCancelled: false }
+
+    const removed = await tx
+      .delete(invitationWorkspaceGrant)
+      .where(
+        and(
+          eq(invitationWorkspaceGrant.invitationId, invitationId),
+          eq(invitationWorkspaceGrant.workspaceId, workspaceId)
+        )
+      )
+      .returning({ id: invitationWorkspaceGrant.id })
+    if (removed.length === 0) return { revoked: false, invitationCancelled: false }
+
+    const [remaining] = await tx
+      .select({ value: count() })
+      .from(invitationWorkspaceGrant)
+      .where(eq(invitationWorkspaceGrant.invitationId, invitationId))
+
+    if ((remaining?.value ?? 0) > 0) {
+      await tx
+        .update(invitation)
+        .set({ updatedAt: new Date() })
+        .where(eq(invitation.id, invitationId))
+      return { revoked: true, invitationCancelled: false }
+    }
+
+    await tx
+      .update(invitation)
+      .set({ status: 'cancelled', updatedAt: new Date() })
+      .where(eq(invitation.id, invitationId))
+    return { revoked: true, invitationCancelled: true }
+  })
+}
+
 /**
  * Pending, unexpired invitations addressed to an email — the invitee-facing
  * list (workspace-switcher Invitations section). Session-bound callers accept
@@ -821,26 +1441,6 @@ export async function listPendingInvitationsForEmail(
   return Promise.all(rows.map((row) => hydrateInvitation(row)))
 }
 
-export async function listPendingInvitationsForOrganization(organizationId: string) {
-  return db
-    .select({
-      id: invitation.id,
-      kind: invitation.kind,
-      email: invitation.email,
-      role: invitation.role,
-      membershipIntent: invitation.membershipIntent,
-      status: invitation.status,
-      expiresAt: invitation.expiresAt,
-      createdAt: invitation.createdAt,
-      inviterName: user.name,
-      inviterEmail: user.email,
-    })
-    .from(invitation)
-    .leftJoin(user, eq(invitation.inviterId, user.id))
-    .where(eq(invitation.organizationId, organizationId))
-    .orderBy(invitation.createdAt)
-}
-
 export async function listInvitationsForWorkspaces(workspaceIds: string[]) {
   if (workspaceIds.length === 0) return []
   return db
diff --git a/apps/sim/lib/invitations/disclosure-copy.test.ts b/apps/sim/lib/invitations/disclosure-copy.test.ts
new file mode 100644
index 00000000000..65ec279303b
--- /dev/null
+++ b/apps/sim/lib/invitations/disclosure-copy.test.ts
@@ -0,0 +1,233 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  buildMembershipNotice,
+  buildWorkspaceMigrationNotice,
+} from '@/lib/invitations/disclosure-copy'
+
+const preview = (over: Partial<Parameters<typeof buildMembershipNotice>[0]['joinPreview']> = {}) =>
+  ({
+    outcome: 'will-join' as const,
+    organizationName: 'Acme',
+    workspacesToMove: [],
+    workspaceIdsToMove: [],
+    ...over,
+  }) as NonNullable<Parameters<typeof buildMembershipNotice>[0]['joinPreview']>
+
+describe('buildMembershipNotice', () => {
+  it('discloses the seat when acceptance will join the organization', () => {
+    const notice = buildMembershipNotice({
+      joinPreview: preview(),
+      membershipIntent: 'internal',
+      isOrganizationAdminRole: false,
+      organizationLabel: 'Acme',
+      isOrganizationScoped: true,
+    })
+
+    expect(notice).toContain('as a member')
+    expect(notice).toContain('uses one of their seats')
+  })
+
+  it('says admin when the invited organization role is an admin role', () => {
+    expect(
+      buildMembershipNotice({
+        joinPreview: preview(),
+        membershipIntent: 'internal',
+        isOrganizationAdminRole: true,
+        organizationLabel: 'Acme',
+        isOrganizationScoped: true,
+      })
+    ).toContain('as an admin')
+  })
+
+  /**
+   * The reason this is keyed on the preview: acceptance downgrades an internal
+   * invite to external when the invitee already belongs to another organization.
+   * Promising a seat there would be a disclosure/outcome mismatch.
+   */
+  it('discloses external when acceptance will NOT join, despite an internal invite', () => {
+    const notice = buildMembershipNotice({
+      joinPreview: preview({ outcome: 'external' }),
+      membershipIntent: 'internal',
+      isOrganizationAdminRole: false,
+      organizationLabel: 'Acme',
+      isOrganizationScoped: true,
+    })
+
+    expect(notice).toContain('external collaborator')
+    expect(notice).toContain("don't take one of their seats")
+    expect(notice).not.toContain('uses one of their seats')
+  })
+
+  /**
+   * An existing member is not external: their standing is unchanged.
+   */
+  it('discloses unchanged standing for an existing member, not external', () => {
+    const notice = buildMembershipNotice({
+      joinPreview: preview({ outcome: 'already-member' }),
+      membershipIntent: 'internal',
+      isOrganizationAdminRole: false,
+      organizationLabel: 'Acme',
+      isOrganizationScoped: true,
+    })
+
+    expect(notice).toContain('already a member of Acme')
+    expect(notice).not.toContain('external collaborator')
+    expect(notice).not.toContain('uses one of their seats')
+  })
+
+  /**
+   * With no preview the outcome is unknown and acceptance runs without the consent
+   * guards, so the copy must not assert a settled outcome.
+   */
+  it('hedges when no preview could be computed', () => {
+    expect(
+      buildMembershipNotice({
+        joinPreview: null,
+        membershipIntent: 'internal',
+        isOrganizationAdminRole: false,
+        organizationLabel: 'Acme',
+        isOrganizationScoped: true,
+      })
+    ).toContain("If you're added")
+
+    expect(
+      buildMembershipNotice({
+        joinPreview: null,
+        membershipIntent: 'internal',
+        isOrganizationAdminRole: false,
+        organizationLabel: 'Acme',
+        isOrganizationScoped: true,
+      })
+    ).not.toContain("You'll join Acme as")
+
+    expect(
+      buildMembershipNotice({
+        joinPreview: null,
+        membershipIntent: 'external',
+        isOrganizationAdminRole: false,
+        organizationLabel: 'Acme',
+        isOrganizationScoped: true,
+      })
+    ).toContain('external collaborator')
+  })
+
+  /**
+   * A personal-workspace invite has no organization name until acceptance
+   * creates one, so the caller must scope on the `will-join` outcome. Pinning the
+   * copy here so the seat is disclosed once it does.
+   */
+  it('discloses the seat for a will-join preview with no organization name yet', () => {
+    expect(
+      buildMembershipNotice({
+        joinPreview: preview({ organizationName: null }),
+        membershipIntent: 'internal',
+        isOrganizationAdminRole: false,
+        organizationLabel: 'the organization',
+        isOrganizationScoped: true,
+      })
+    ).toContain('uses one of their seats')
+  })
+
+  /**
+   * Acceptance will fail (`upgrade-required` / `workspace-not-found`), so nothing
+   * is promised. The boolean shape forced this case to render the external copy,
+   * which told people they were getting free workspace access they would never
+   * receive.
+   */
+  it('promises nothing when acceptance will be blocked', () => {
+    expect(
+      buildMembershipNotice({
+        joinPreview: preview({ outcome: 'blocked' }),
+        membershipIntent: 'internal',
+        isOrganizationAdminRole: false,
+        organizationLabel: 'Acme',
+        isOrganizationScoped: true,
+      })
+    ).toBe('')
+  })
+
+  it('moves nothing when acceptance will be blocked', () => {
+    expect(
+      buildWorkspaceMigrationNotice({
+        joinPreview: preview({ outcome: 'blocked', workspacesToMove: ['Alpha'] }),
+        joinPreviewUnavailable: false,
+        membershipIntent: 'internal',
+        organizationLabel: 'Acme',
+      })
+    ).toBe('')
+  })
+
+  it('says nothing for an invitation with no organization standing', () => {
+    expect(
+      buildMembershipNotice({
+        joinPreview: null,
+        membershipIntent: 'internal',
+        isOrganizationAdminRole: false,
+        organizationLabel: 'the organization',
+        isOrganizationScoped: false,
+      })
+    ).toBe('')
+  })
+})
+
+describe('buildWorkspaceMigrationNotice', () => {
+  it('names the workspaces that will move', () => {
+    const notice = buildWorkspaceMigrationNotice({
+      joinPreview: preview({ workspacesToMove: ['Alpha', 'Beta'] }),
+      joinPreviewUnavailable: false,
+      membershipIntent: 'internal',
+      organizationLabel: 'Acme',
+    })
+
+    expect(notice).toContain('"Alpha", "Beta"')
+    expect(notice).toContain('into Acme')
+  })
+
+  it('collapses a long list into an overflow tail', () => {
+    expect(
+      buildWorkspaceMigrationNotice({
+        joinPreview: preview({ workspacesToMove: ['A', 'B', 'C', 'D'] }),
+        joinPreviewUnavailable: false,
+        membershipIntent: 'internal',
+        organizationLabel: 'Acme',
+      })
+    ).toContain('and 1 more')
+  })
+
+  it('says nothing when nothing will move', () => {
+    expect(
+      buildWorkspaceMigrationNotice({
+        joinPreview: preview({ outcome: 'will-join', workspacesToMove: [] }),
+        joinPreviewUnavailable: false,
+        membershipIntent: 'internal',
+        organizationLabel: 'Acme',
+      })
+    ).toBe('')
+  })
+
+  /** A missing preview must never read as "nothing moves". */
+  it('falls back to a generic warning when the preview is unavailable', () => {
+    expect(
+      buildWorkspaceMigrationNotice({
+        joinPreview: null,
+        joinPreviewUnavailable: true,
+        membershipIntent: 'internal',
+        organizationLabel: 'Acme',
+      })
+    ).toContain('If you own personal workspaces')
+  })
+
+  it('warns about nothing for an external invite, which moves nothing', () => {
+    expect(
+      buildWorkspaceMigrationNotice({
+        joinPreview: null,
+        joinPreviewUnavailable: true,
+        membershipIntent: 'external',
+        organizationLabel: 'Acme',
+      })
+    ).toBe('')
+  })
+})
diff --git a/apps/sim/lib/invitations/disclosure-copy.ts b/apps/sim/lib/invitations/disclosure-copy.ts
new file mode 100644
index 00000000000..147b6520f82
--- /dev/null
+++ b/apps/sim/lib/invitations/disclosure-copy.ts
@@ -0,0 +1,117 @@
+import { formatQuotedNameList } from '@sim/utils/string'
+import type { InvitationJoinPreview } from '@/lib/api/contracts/invitations'
+
+/**
+ * Disclosure copy shown to an invitee before they accept.
+ *
+ * Shared by every accept surface — the emailed `/invite` page and the in-app
+ * pending-invitations modal — so the two can never disclose different
+ * consequences for the same invitation. An accept path that renders none of
+ * this is a consent gap, not a styling difference.
+ */
+
+/** Names listed before collapsing the rest into an "and N more" tail. */
+export const MAX_LISTED_WORKSPACE_NAMES = 3
+
+/**
+ * Names the invitee's own workspaces that accepting will move into the
+ * organization, so accepting never silently changes who controls their work.
+ *
+ * Returns the itemized notice when the preview resolved, a generic one when it
+ * could not be computed (a missing preview must never read as "nothing moves"),
+ * and an empty string when nothing will move.
+ */
+export function buildWorkspaceMigrationNotice({
+  joinPreview,
+  joinPreviewUnavailable,
+  membershipIntent,
+  organizationLabel,
+}: {
+  joinPreview: InvitationJoinPreview | null
+  joinPreviewUnavailable: boolean
+  membershipIntent: 'internal' | 'external' | undefined
+  organizationLabel: string
+}): string {
+  if (joinPreviewUnavailable && membershipIntent !== 'external') {
+    return ` If you own personal workspaces, accepting membership moves them into ${organizationLabel}: its admins get full access, and they stay with the organization if you leave.`
+  }
+
+  if (joinPreview?.outcome !== 'will-join' || joinPreview.workspacesToMove.length === 0) {
+    return ''
+  }
+
+  const names = joinPreview.workspacesToMove
+  const nameList = formatQuotedNameList(names, MAX_LISTED_WORKSPACE_NAMES)
+  const single = names.length === 1
+
+  return ` Accepting also moves your ${single ? 'workspace' : 'workspaces'} ${nameList} into ${organizationLabel}: its admins get full access, and ${single ? 'it stays' : 'they stay'} with the organization if you leave.`
+}
+
+/**
+ * States what the invitee becomes, so the seat consequence is disclosed to the
+ * person it applies to rather than only to the inviter.
+ *
+ * Keyed on the preview's resolved `outcome` rather than the invitation's sent
+ * intent, because acceptance can resolve an internal invite to something else —
+ * the invitee already belongs to an organization, the granted workspace changed
+ * organizations since the invite was sent, or acceptance will fail outright.
+ * Promising a seat in those cases is exactly the disclosure/outcome mismatch
+ * these notices exist to prevent. The sent intent is only the fallback for when
+ * the preview could not be computed.
+ */
+export function buildMembershipNotice({
+  joinPreview,
+  membershipIntent,
+  isOrganizationAdminRole,
+  organizationLabel,
+  isOrganizationScoped,
+}: {
+  joinPreview: InvitationJoinPreview | null
+  membershipIntent: 'internal' | 'external' | undefined
+  isOrganizationAdminRole: boolean
+  organizationLabel: string
+  isOrganizationScoped: boolean
+}): string {
+  if (!isOrganizationScoped || !membershipIntent) return ''
+
+  /**
+   * No preview means the outcome is genuinely unknown, and the callers also send
+   * no disclosure token, so acceptance runs without the consent guards. Asserting
+   * a seat-taking join here would be a promise nothing verifies — acceptance may
+   * resolve to external, already-a-member, or a failure. The copy is conditional
+   * instead: the consequence is still disclosed, without claiming it as settled.
+   */
+  if (!joinPreview) {
+    if (membershipIntent === 'external') {
+      return ` You'll join as an external collaborator: you get access to the invited workspaces only, and you don't take one of their seats.`
+    }
+    return ` If you're added to ${organizationLabel} as a member, that uses one of their seats.`
+  }
+
+  const outcome = joinPreview.outcome
+
+  switch (outcome) {
+    /**
+     * Acceptance will fail (`upgrade-required`, `workspace-not-found`), so
+     * nothing is promised. Silence is the honest answer: the invitee sees the
+     * real cause when they accept. Claiming external access here — which is what
+     * a boolean shape forced — was actively false.
+     */
+    case 'blocked':
+      return ''
+    /**
+     * Already in the organization: their standing is unchanged, so neither the
+     * join copy nor the external copy is true.
+     */
+    case 'already-member':
+      return ` You're already a member of ${organizationLabel}, so accepting only adds the workspaces above — your membership and seat don't change.`
+    case 'external':
+      return ` You'll join as an external collaborator: you get access to the ${
+        organizationLabel === 'the organization' ? 'invited' : organizationLabel
+      } workspaces only, you don't take one of their seats, and everything you own stays yours.`
+    case 'will-join':
+      return ` You'll join ${organizationLabel} as ${
+        isOrganizationAdminRole ? 'an admin' : 'a member'
+      }, which uses one of their seats.`
+  }
+}
diff --git a/apps/sim/lib/invitations/error-messages.ts b/apps/sim/lib/invitations/error-messages.ts
index 629356c6518..565b3e56990 100644
--- a/apps/sim/lib/invitations/error-messages.ts
+++ b/apps/sim/lib/invitations/error-messages.ts
@@ -19,6 +19,11 @@ const INVITATION_ERROR_MESSAGES: Record<string, string> = {
     'This organization has reached its seat limit. Ask an admin to add seats, then try again.',
   'upgrade-required':
     'The workspace owner needs an active paid plan before you can join. Ask them to update it, then try again.',
+  'external-requires-paid-plan':
+    'External collaborators need their own paid Sim plan. Upgrade your plan, or ask the organization to re-invite you as a member — that uses one of their seats instead.',
+  'disclosure-outdated':
+    'What accepting does changed since this list loaded. Reopen your invitations to see the updated details, then accept again.',
+  'workspace-not-found': 'The workspace this invitation points at could not be found.',
   'server-error': 'Something went wrong processing the invitation. Please try again.',
 }
 
diff --git a/apps/sim/lib/invitations/send.test.ts b/apps/sim/lib/invitations/send.test.ts
new file mode 100644
index 00000000000..cd2187609dd
--- /dev/null
+++ b/apps/sim/lib/invitations/send.test.ts
@@ -0,0 +1,37 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { createPendingInvitation, GrantlessInvitationError } from '@/lib/invitations/send'
+
+describe('createPendingInvitation', () => {
+  it.each(['member', 'admin'] as const)(
+    'rejects a %s-role organization invitation with no workspace grants',
+    async (role) => {
+      await expect(
+        createPendingInvitation({
+          kind: 'organization',
+          email: 'invitee@example.com',
+          inviterId: 'inviter-1',
+          organizationId: 'org-1',
+          role,
+          grants: [],
+        })
+      ).rejects.toThrow(GrantlessInvitationError)
+    }
+  )
+
+  it('rejects a workspace invitation with no workspace grants', async () => {
+    await expect(
+      createPendingInvitation({
+        kind: 'workspace',
+        email: 'invitee@example.com',
+        inviterId: 'inviter-1',
+        organizationId: 'org-1',
+        membershipIntent: 'internal',
+        role: 'member',
+        grants: [],
+      })
+    ).rejects.toThrow(GrantlessInvitationError)
+  })
+})
diff --git a/apps/sim/lib/invitations/send.ts b/apps/sim/lib/invitations/send.ts
index 4ca449cfb5a..661cc968be5 100644
--- a/apps/sim/lib/invitations/send.ts
+++ b/apps/sim/lib/invitations/send.ts
@@ -8,9 +8,11 @@ import {
   workspace,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
+import { getPostgresConstraintName, getPostgresErrorCode } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { normalizeEmail } from '@sim/utils/string'
-import { and, eq, inArray, ne, sql } from 'drizzle-orm'
+import { and, asc, eq, inArray, ne, sql } from 'drizzle-orm'
 import {
   getEmailSubject,
   renderBatchInvitationEmail,
@@ -19,6 +21,7 @@ import {
   renderWorkspaceInvitationEmail,
 } from '@/components/emails'
 import { getBaseUrl } from '@/lib/core/utils/urls'
+import type { DbOrTx } from '@/lib/db/types'
 import { computeInvitationExpiry } from '@/lib/invitations/core'
 import { acquireInvitationMutationLocks } from '@/lib/invitations/locks'
 import { sendEmail } from '@/lib/messaging/email/mailer'
@@ -47,39 +50,224 @@ export interface CreatePendingInvitationResult {
   invitationId: string
   token: string
   expiresAt: Date
+  /**
+   * False when the grants were merged into an invitation that was already
+   * pending for this (email, organization). Callers compensating for a failed
+   * send must revert only the added grants in that case — cancelling would
+   * destroy an unrelated, still-valid invitation.
+   */
+  created: boolean
+  /** Workspaces this call added; empty when every grant was already present. */
+  addedWorkspaceIds: string[]
+  /** Every workspace the invitation now grants, oldest grant first. */
+  grants: WorkspaceGrantInput[]
+}
+
+/**
+ * Partial unique index on `invitation (email, organization_id) WHERE status =
+ * 'pending' AND organization_id IS NOT NULL` — one pending invitation per
+ * person per organization, which is what makes coalescing mandatory rather
+ * than optional.
+ */
+const PENDING_INVITATION_UNIQUE_INDEX = 'invitation_pending_email_org_unique'
+
+/**
+ * Raised when the granted workspaces changed organization between the
+ * pre-lock lookup and the lock itself, so the invitation that would be merged
+ * into was never covered by the acquired locks. Retrying re-resolves the
+ * organization and locks the right row.
+ */
+class InvitationScopeChangedError extends Error {
+  constructor() {
+    super('Invitation organization scope changed while acquiring locks')
+    this.name = 'InvitationScopeChangedError'
+  }
+}
+
+function isPendingInvitationConflict(error: unknown): boolean {
+  return (
+    error instanceof InvitationScopeChangedError ||
+    (getPostgresErrorCode(error) === '23505' &&
+      getPostgresConstraintName(error) === PENDING_INVITATION_UNIQUE_INDEX)
+  )
+}
+
+/**
+ * The organization an invitation is stamped with. Workspace invitations derive
+ * it from the granted workspaces' live organization so a workspace that moved
+ * since the inviter loaded the page is stamped with where it actually lives.
+ */
+async function resolveInvitationOrganizationId(
+  executor: DbOrTx,
+  input: CreatePendingInvitationInput,
+  workspaceIds: string[]
+): Promise<string | null> {
+  if (input.kind !== 'workspace' || workspaceIds.length === 0) return input.organizationId
+
+  const currentScopes = await executor
+    .select({ organizationId: workspace.organizationId })
+    .from(workspace)
+    .where(inArray(workspace.id, workspaceIds))
+  const uniqueScopes = [...new Set(currentScopes.map((row) => row.organizationId))]
+  return uniqueScopes.length === 1 ? uniqueScopes[0] : input.organizationId
 }
 
+async function findPendingOrganizationInvitation(
+  executor: DbOrTx,
+  organizationId: string,
+  email: string
+) {
+  const [row] = await executor
+    .select({
+      id: invitation.id,
+      token: invitation.token,
+      expiresAt: invitation.expiresAt,
+      role: invitation.role,
+      membershipIntent: invitation.membershipIntent,
+    })
+    .from(invitation)
+    .where(
+      and(
+        eq(invitation.organizationId, organizationId),
+        eq(invitation.email, email),
+        eq(invitation.status, 'pending')
+      )
+    )
+    .limit(1)
+  return row ?? null
+}
+
+function describeInvitationStanding(
+  membershipIntent: InvitationMembershipIntent,
+  role: string
+): string {
+  if (membershipIntent === 'external') return 'an external collaborator'
+  return isOrgAdminRole(role) ? 'an organization admin' : 'an organization member'
+}
+
+/**
+ * Thrown when new workspaces would merge into a pending invitation that grants
+ * a different standing. Adding workspaces must never quietly re-decide whether
+ * the invitee takes a seat or becomes an admin, and neither silent outcome is
+ * right — the old choice ignores what the inviter just asked for, the new one
+ * rewrites an invitation somebody else may have sent. The inviter resolves it.
+ */
+export class ConflictingPendingInvitationError extends Error {
+  constructor(params: {
+    email: string
+    existing: { membershipIntent: InvitationMembershipIntent; role: string }
+    requested: { membershipIntent: InvitationMembershipIntent; role: string }
+  }) {
+    super(
+      `${params.email} already has a pending invitation as ${describeInvitationStanding(
+        params.existing.membershipIntent,
+        params.existing.role
+      )}. Cancel it before inviting them as ${describeInvitationStanding(
+        params.requested.membershipIntent,
+        params.requested.role
+      )}.`
+    )
+    this.name = 'ConflictingPendingInvitationError'
+  }
+}
+
+/**
+ * Thrown when an invitation carries no workspace grants. Every invitation names
+ * at least one workspace, so accepting always lands the invitee somewhere
+ * concrete and the email can say what they are being given. Admins would derive
+ * access to every organization workspace anyway, but a grantless admin invite
+ * still reads as "join this organization" with nothing to open, so it is
+ * rejected too. Enforced here so every creation path — routes, admin tooling,
+ * future callers — hits the same rule.
+ */
+export class GrantlessInvitationError extends Error {
+  constructor() {
+    super(
+      'Invitations must include at least one workspace so the invitee has a workspace to land in.'
+    )
+    this.name = 'GrantlessInvitationError'
+  }
+}
+
+/**
+ * Creates a pending invitation, or extends the one already pending for this
+ * (email, organization) with the workspaces it does not cover yet.
+ *
+ * Coalescing is required, not a convenience: a person can hold at most one
+ * pending invitation per organization, so inviting them to a second workspace
+ * has to become another grant on the same invitation. It also gives the
+ * invitee one link that grants everything they were invited to, instead of a
+ * queue of invitations to accept one at a time.
+ *
+ * Invitations with no organization (personal-workspace invites) are never
+ * coalesced — they are scoped to their inviter, and acceptance converts *that*
+ * inviter's plan, so two inviters' invites must stay independent.
+ */
 export async function createPendingInvitation(
   input: CreatePendingInvitationInput
 ): Promise<CreatePendingInvitationResult> {
-  const invitationId = generateId()
+  if (input.grants.length === 0) {
+    throw new GrantlessInvitationError()
+  }
+
+  try {
+    return await createOrExtendPendingInvitation(input)
+  } catch (error) {
+    if (!isPendingInvitationConflict(error)) throw error
+    /**
+     * A concurrent invite created the pending row, or moved a granted
+     * workspace, between the pre-lock lookup and the insert. The retry sees
+     * the committed row and merges into it.
+     */
+    return createOrExtendPendingInvitation(input)
+  }
+}
+
+async function createOrExtendPendingInvitation(
+  input: CreatePendingInvitationInput
+): Promise<CreatePendingInvitationResult> {
+  const email = normalizeEmail(input.email)
+  const workspaceIds = input.grants.map((grant) => grant.workspaceId)
+
+  /**
+   * Resolved before the transaction so the invitation being merged into can
+   * join the same sorted lock acquisition. Advisory locks must be taken in one
+   * call — invitation keys sort before workspace keys, matching the order
+   * acceptance takes them in, so the two paths cannot deadlock.
+   */
+  const scopeOrganizationId = await resolveInvitationOrganizationId(db, input, workspaceIds)
+  const knownPendingId = scopeOrganizationId
+    ? (await findPendingOrganizationInvitation(db, scopeOrganizationId, email))?.id
+    : undefined
+
+  const newInvitationId = generateId()
   const token = generateId()
   const expiresAt = input.expiresAt ?? computeInvitationExpiry()
   const now = new Date()
 
-  await db.transaction(async (tx) => {
-    const workspaceIds = input.grants.map((grant) => grant.workspaceId)
+  return db.transaction(async (tx) => {
     await acquireInvitationMutationLocks(tx, {
-      invitationIds: [invitationId],
+      invitationIds: knownPendingId ? [knownPendingId, newInvitationId] : [newInvitationId],
       workspaceIds,
     })
 
-    let organizationId = input.organizationId
-    if (input.kind === 'workspace' && workspaceIds.length > 0) {
-      const currentScopes = await tx
-        .select({ organizationId: workspace.organizationId })
-        .from(workspace)
-        .where(inArray(workspace.id, workspaceIds))
-      const uniqueScopes = [...new Set(currentScopes.map((row) => row.organizationId))]
-      if (uniqueScopes.length === 1) {
-        organizationId = uniqueScopes[0]
-      }
+    const organizationId = await resolveInvitationOrganizationId(tx, input, workspaceIds)
+    const existing = organizationId
+      ? await findPendingOrganizationInvitation(tx, organizationId, email)
+      : null
+
+    if (existing && existing.id !== knownPendingId) {
+      throw new InvitationScopeChangedError()
+    }
+
+    if (existing) {
+      return extendPendingInvitation(tx, { existing, input, expiresAt, now })
     }
 
     await tx.insert(invitation).values({
-      id: invitationId,
+      id: newInvitationId,
       kind: input.kind,
-      email: normalizeEmail(input.email),
+      email,
       inviterId: input.inviterId,
       organizationId,
       membershipIntent: input.membershipIntent ?? 'internal',
@@ -94,16 +282,127 @@ export async function createPendingInvitation(
     for (const grant of input.grants) {
       await tx.insert(invitationWorkspaceGrant).values({
         id: generateId(),
-        invitationId,
+        invitationId: newInvitationId,
         workspaceId: grant.workspaceId,
         permission: grant.permission,
         createdAt: now,
         updatedAt: now,
       })
     }
+
+    return {
+      invitationId: newInvitationId,
+      token,
+      expiresAt,
+      created: true,
+      addedWorkspaceIds: workspaceIds,
+      grants: input.grants,
+    }
   })
+}
+
+/**
+ * Adds the grants an already-pending invitation is missing. Its kind, role, and
+ * membership intent are left alone — they decide what acceptance does to the
+ * invitee's organization membership, and adding a workspace is not consent to
+ * change that — so a request for a different standing is rejected above rather
+ * than resolved silently. Permissions on grants that already exist are likewise
+ * untouched, so an invite can never downgrade access already promised.
+ */
+async function extendPendingInvitation(
+  tx: DbOrTx,
+  params: {
+    existing: {
+      id: string
+      token: string
+      expiresAt: Date
+      role: string
+      membershipIntent: InvitationMembershipIntent
+    }
+    input: CreatePendingInvitationInput
+    expiresAt: Date
+    now: Date
+  }
+): Promise<CreatePendingInvitationResult> {
+  const { existing, input, expiresAt, now } = params
+
+  const requestedIntent = input.membershipIntent ?? 'internal'
+  if (
+    existing.membershipIntent !== requestedIntent ||
+    isOrgAdminRole(existing.role) !== isOrgAdminRole(input.role)
+  ) {
+    throw new ConflictingPendingInvitationError({
+      email: normalizeEmail(input.email),
+      existing: { membershipIntent: existing.membershipIntent, role: existing.role },
+      requested: { membershipIntent: requestedIntent, role: input.role },
+    })
+  }
+
+  const existingGrants = await tx
+    .select({
+      workspaceId: invitationWorkspaceGrant.workspaceId,
+      permission: invitationWorkspaceGrant.permission,
+    })
+    .from(invitationWorkspaceGrant)
+    .where(eq(invitationWorkspaceGrant.invitationId, existing.id))
+    .orderBy(asc(invitationWorkspaceGrant.createdAt), asc(invitationWorkspaceGrant.id))
+
+  const grantedWorkspaceIds = new Set(existingGrants.map((grant) => grant.workspaceId))
+  const addedGrants = input.grants.filter((grant) => !grantedWorkspaceIds.has(grant.workspaceId))
 
-  return { invitationId, token, expiresAt }
+  for (const grant of addedGrants) {
+    await tx.insert(invitationWorkspaceGrant).values({
+      id: generateId(),
+      invitationId: existing.id,
+      workspaceId: grant.workspaceId,
+      permission: grant.permission,
+      createdAt: now,
+      updatedAt: now,
+    })
+  }
+
+  /**
+   * Extending expiry keeps a late-added workspace from riding an almost-dead
+   * link. It only ever moves the deadline out, so it needs no compensation
+   * when the send fails.
+   */
+  const nextExpiresAt = existing.expiresAt > expiresAt ? existing.expiresAt : expiresAt
+  if (addedGrants.length > 0) {
+    await tx
+      .update(invitation)
+      .set({ expiresAt: nextExpiresAt, updatedAt: now })
+      .where(eq(invitation.id, existing.id))
+  }
+
+  return {
+    invitationId: existing.id,
+    token: existing.token,
+    expiresAt: nextExpiresAt,
+    created: false,
+    addedWorkspaceIds: addedGrants.map((grant) => grant.workspaceId),
+    grants: [...existingGrants, ...addedGrants],
+  }
+}
+
+/**
+ * Undoes the grants a failed send added to a pre-existing invitation. The
+ * invitation itself survives — it was valid before this call and the
+ * workspaces it already covered are unaffected.
+ */
+export async function revertPendingInvitationGrants(params: {
+  invitationId: string
+  workspaceIds: string[]
+}): Promise<void> {
+  if (params.workspaceIds.length === 0) return
+
+  await db
+    .delete(invitationWorkspaceGrant)
+    .where(
+      and(
+        eq(invitationWorkspaceGrant.invitationId, params.invitationId),
+        inArray(invitationWorkspaceGrant.workspaceId, params.workspaceIds)
+      )
+    )
 }
 
 async function countPendingInvitationsForOrganization(organizationId: string): Promise<number> {
@@ -120,62 +419,29 @@ async function countPendingInvitationsForOrganization(organizationId: string): P
   return row?.count ?? 0
 }
 
-async function findPendingInvitationByOrgEmail(params: {
-  organizationId: string | null
+/**
+ * Workspaces this email already holds a pending grant for, across every
+ * pending invitation. Callers use it to drop workspaces from a new invite
+ * rather than rejecting the whole thing.
+ */
+export async function findPendingGrantWorkspaceIds(params: {
+  workspaceIds: string[]
   email: string
-}) {
-  const normalized = normalizeEmail(params.email)
-
-  if (params.organizationId) {
-    const [row] = await db
-      .select()
-      .from(invitation)
-      .where(
-        and(
-          eq(invitation.organizationId, params.organizationId),
-          eq(invitation.email, normalized),
-          eq(invitation.status, 'pending')
-        )
-      )
-      .limit(1)
-    return row ?? null
-  }
-
-  const [row] = await db
-    .select()
-    .from(invitation)
-    .where(
-      and(
-        sql`${invitation.organizationId} IS NULL`,
-        eq(invitation.email, normalized),
-        eq(invitation.status, 'pending')
-      )
-    )
-    .limit(1)
-  return row ?? null
-}
+}): Promise<Set<string>> {
+  if (params.workspaceIds.length === 0) return new Set()
 
-export async function findPendingGrantForWorkspaceEmail(params: {
-  workspaceId: string
-  email: string
-}) {
-  const normalized = normalizeEmail(params.email)
-  const [row] = await db
-    .select({
-      invitationId: invitation.id,
-      grantId: invitationWorkspaceGrant.id,
-    })
+  const rows = await db
+    .select({ workspaceId: invitationWorkspaceGrant.workspaceId })
     .from(invitationWorkspaceGrant)
     .innerJoin(invitation, eq(invitation.id, invitationWorkspaceGrant.invitationId))
     .where(
       and(
-        eq(invitationWorkspaceGrant.workspaceId, params.workspaceId),
-        eq(invitation.email, normalized),
+        inArray(invitationWorkspaceGrant.workspaceId, params.workspaceIds),
+        eq(invitation.email, normalizeEmail(params.email)),
         eq(invitation.status, 'pending')
       )
     )
-    .limit(1)
-  return row ?? null
+  return new Set(rows.map((row) => row.workspaceId))
 }
 
 export async function cancelPendingInvitation(invitationId: string): Promise<void> {
diff --git a/apps/sim/lib/invitations/workspace-invitations.test.ts b/apps/sim/lib/invitations/workspace-invitations.test.ts
index 819337b96e2..0db54229533 100644
--- a/apps/sim/lib/invitations/workspace-invitations.test.ts
+++ b/apps/sim/lib/invitations/workspace-invitations.test.ts
@@ -1,8 +1,15 @@
 /**
  * @vitest-environment node
  */
-import { auditMock, createMockRequest, dbChainMockFns, resetDbChainMock } from '@sim/testing'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  auditMock,
+  createMockRequest,
+  dbChainMockFns,
+  resetDbChainMock,
+  resetEnvFlagsMock,
+  setEnvFlags,
+} from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   mockGetUserOrganization,
@@ -11,7 +18,10 @@ const {
   mockCreatePendingInvitation,
   mockSendInvitationEmail,
   mockCancelPendingInvitation,
-  mockFindPendingGrantForWorkspaceEmail,
+  mockRevertPendingInvitationGrants,
+  mockFindPendingGrantWorkspaceIds,
+  mockGetInvitePlanCategoryForUser,
+  mockIsOrganizationOwnerOrAdmin,
   mockWorkspaceMemberInvited,
   mockCaptureServerEvent,
 } = vi.hoisted(() => ({
@@ -21,7 +31,10 @@ const {
   mockCreatePendingInvitation: vi.fn(),
   mockSendInvitationEmail: vi.fn(),
   mockCancelPendingInvitation: vi.fn(),
-  mockFindPendingGrantForWorkspaceEmail: vi.fn(),
+  mockRevertPendingInvitationGrants: vi.fn(),
+  mockFindPendingGrantWorkspaceIds: vi.fn(),
+  mockGetInvitePlanCategoryForUser: vi.fn(),
+  mockIsOrganizationOwnerOrAdmin: vi.fn(),
   mockWorkspaceMemberInvited: vi.fn(),
   mockCaptureServerEvent: vi.fn(),
 }))
@@ -48,7 +61,8 @@ vi.mock('@/lib/invitations/send', () => ({
   createPendingInvitation: mockCreatePendingInvitation,
   sendInvitationEmail: mockSendInvitationEmail,
   cancelPendingInvitation: mockCancelPendingInvitation,
-  findPendingGrantForWorkspaceEmail: mockFindPendingGrantForWorkspaceEmail,
+  revertPendingInvitationGrants: mockRevertPendingInvitationGrants,
+  findPendingGrantWorkspaceIds: mockFindPendingGrantWorkspaceIds,
 }))
 
 vi.mock('@/lib/posthog/server', () => ({
@@ -59,8 +73,13 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
   getWorkspaceWithOwner: vi.fn(),
 }))
 
+vi.mock('@/lib/billing/core/organization', () => ({
+  isOrganizationOwnerOrAdmin: mockIsOrganizationOwnerOrAdmin,
+}))
+
 vi.mock('@/lib/workspaces/policy', () => ({
   getWorkspaceInvitePolicy: vi.fn(),
+  getInvitePlanCategoryForUser: mockGetInvitePlanCategoryForUser,
 }))
 
 vi.mock('@/ee/access-control/utils/permission-check', () => ({
@@ -81,26 +100,33 @@ function queueWhereResponses(responses: unknown[][]) {
   })
 }
 
-function makeContext() {
+function makeTarget(workspaceId: string, organizationId: string | null = 'org-1') {
   return {
-    workspaceId: 'ws-1',
-    inviterId: 'user-1',
-    inviterName: 'Owner',
-    inviterEmail: 'owner@example.com',
+    workspaceId,
     workspaceDetails: {
-      id: 'ws-1',
-      name: 'Workspace 1',
+      id: workspaceId,
+      name: `Workspace ${workspaceId}`,
       ownerId: 'user-1',
-      organizationId: 'org-1',
+      organizationId,
       billedAccountUserId: 'user-1',
     },
     invitePolicy: {
       allowed: true,
       reason: null,
       requiresSeat: false,
-      organizationId: 'org-1',
+      organizationId,
       upgradeRequired: false,
     },
+  }
+}
+
+function makeContext(workspaceIds = ['ws-1'], organizationId: string | null = 'org-1') {
+  return {
+    inviterId: 'user-1',
+    inviterName: 'Owner',
+    inviterEmail: 'owner@example.com',
+    organizationId,
+    targets: workspaceIds.map((id) => makeTarget(id, organizationId)),
     // The function only reads the fields above at runtime.
   } as Parameters<typeof createWorkspaceInvitation>[0]['context']
 }
@@ -112,14 +138,27 @@ const request = createMockRequest(
   'http://localhost/api/workspaces/invitations/batch'
 )
 
+afterAll(resetEnvFlagsMock)
+
 describe('createWorkspaceInvitation', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    /** Production default; the billing-disabled case opts out explicitly. */
+    setEnvFlags({ isBillingEnabled: true })
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(false)
     mockGrantWorkspaceAccessDirectly.mockResolvedValue({ outcome: 'added', permission: 'write' })
-    mockCreatePendingInvitation.mockResolvedValue({ invitationId: 'inv-1', token: 'tok-1' })
+    mockCreatePendingInvitation.mockResolvedValue({
+      invitationId: 'inv-1',
+      token: 'tok-1',
+      expiresAt: new Date(),
+      created: true,
+      addedWorkspaceIds: ['ws-1'],
+      grants: [{ workspaceId: 'ws-1', permission: 'write' }],
+    })
     mockSendInvitationEmail.mockResolvedValue({ success: true })
-    mockFindPendingGrantForWorkspaceEmail.mockResolvedValue(null)
+    mockFindPendingGrantWorkspaceIds.mockResolvedValue(new Set())
+    mockGetInvitePlanCategoryForUser.mockResolvedValue('free')
   })
 
   it('directly grants access to an existing member of the workspace organization', async () => {
@@ -150,7 +189,7 @@ describe('createWorkspaceInvitation', () => {
   it('rejects an existing workspace member without upgrading their permission', async () => {
     queueWhereResponses([
       [{ id: 'user-2', email: 'member@example.com' }],
-      [{ id: 'perm-1', permissionType: 'read' }],
+      [{ workspaceId: 'ws-1' }],
     ])
     mockGetUserOrganization.mockResolvedValueOnce({ organizationId: 'org-1', role: 'member' })
 
@@ -200,7 +239,7 @@ describe('createWorkspaceInvitation', () => {
     expect(result.instantAdd).toBeFalsy()
     expect(mockGrantWorkspaceAccessDirectly).not.toHaveBeenCalled()
     expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
-      expect.objectContaining({ kind: 'workspace', membershipIntent: 'internal' })
+      expect.objectContaining({ kind: 'workspace', membershipIntent: 'internal', role: 'member' })
     )
   })
 
@@ -221,4 +260,232 @@ describe('createWorkspaceInvitation', () => {
       expect.objectContaining({ kind: 'workspace', membershipIntent: 'internal' })
     )
   })
+
+  it('stamps an admin organization role when an org admin picks Admin membership', async () => {
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(true)
+    queueWhereResponses([[]])
+
+    await createWorkspaceInvitation({
+      context: makeContext(),
+      email: 'new@example.com',
+      permission: 'write',
+      membership: 'admin',
+      request,
+    })
+
+    expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
+      expect.objectContaining({ membershipIntent: 'internal', role: 'admin' })
+    )
+  })
+
+  it('allows an external invite with billing disabled, where nobody has a plan', async () => {
+    /**
+     * The paid-plan requirement is seat economics: an external collaborator takes
+     * no seat, so somebody else must be paying for them. With billing off there
+     * are no seats and no subscriptions, so every account reads as free —
+     * enforcing it would leave a self-hosted deployment no way to grant
+     * workspace-only access without an organization join and a workspace sweep.
+     */
+    setEnvFlags({ isBillingEnabled: false })
+    queueWhereResponses([[{ id: 'user-9', email: 'selfhost@example.com' }], []])
+    mockGetUserOrganization.mockResolvedValueOnce(null)
+
+    const result = await createWorkspaceInvitation({
+      context: makeContext(),
+      email: 'selfhost@example.com',
+      permission: 'write',
+      membership: 'external',
+      request,
+    })
+
+    expect(result.membershipIntent).toBe('external')
+    /** Short-circuits before the plan lookup — there is nothing to look up. */
+    expect(mockGetInvitePlanCategoryForUser).not.toHaveBeenCalled()
+  })
+
+  it('refuses to grant organization Admin to a workspace-only administrator', async () => {
+    /**
+     * Organization Admin carries admin on every workspace the org owns plus
+     * member and billing management, so workspace-scoped authority must not
+     * escalate into it. Enforced server-side because the batch endpoint is
+     * reachable without the modal.
+     */
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(false)
+    queueWhereResponses([[]])
+
+    await expect(
+      createWorkspaceInvitation({
+        context: makeContext(),
+        email: 'new@example.com',
+        permission: 'write',
+        membership: 'admin',
+        request,
+      })
+    ).rejects.toThrow('Only an organization owner or admin')
+
+    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
+  })
+
+  it('rejects an explicit external invite for an invitee with no paid plan', async () => {
+    queueWhereResponses([[{ id: 'user-5', email: 'free@example.com' }], []])
+    mockGetUserOrganization.mockResolvedValueOnce(null)
+    mockGetInvitePlanCategoryForUser.mockResolvedValueOnce('free')
+
+    await expect(
+      createWorkspaceInvitation({
+        context: makeContext(),
+        email: 'free@example.com',
+        permission: 'write',
+        membership: 'external',
+        request,
+      })
+    ).rejects.toThrow('not on a paid Sim plan')
+
+    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
+  })
+
+  it('rejects an explicit external invite for an email with no Sim account', async () => {
+    queueWhereResponses([[]])
+
+    await expect(
+      createWorkspaceInvitation({
+        context: makeContext(),
+        email: 'stranger@example.com',
+        permission: 'write',
+        membership: 'external',
+        request,
+      })
+    ).rejects.toThrow('not on a paid Sim plan')
+
+    expect(mockGetInvitePlanCategoryForUser).not.toHaveBeenCalled()
+    expect(mockCreatePendingInvitation).not.toHaveBeenCalled()
+  })
+
+  it('allows an explicit external invite for an invitee on their own paid plan', async () => {
+    queueWhereResponses([[{ id: 'user-6', email: 'pro@example.com' }], []])
+    mockGetUserOrganization.mockResolvedValueOnce(null)
+    mockGetInvitePlanCategoryForUser.mockResolvedValueOnce('pro')
+
+    const result = await createWorkspaceInvitation({
+      context: makeContext(),
+      email: 'pro@example.com',
+      permission: 'write',
+      membership: 'external',
+      request,
+    })
+
+    expect(result.membershipIntent).toBe('external')
+    expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
+      expect.objectContaining({ membershipIntent: 'external' })
+    )
+  })
+
+  it('rejects an external invite on a personal workspace', async () => {
+    queueWhereResponses([[{ id: 'user-7', email: 'pro@example.com' }], []])
+
+    await expect(
+      createWorkspaceInvitation({
+        context: makeContext(['ws-personal'], null),
+        email: 'pro@example.com',
+        permission: 'write',
+        membership: 'external',
+        request,
+      })
+    ).rejects.toThrow('only available on organization workspaces')
+  })
+
+  it('sends one invitation covering every selected workspace', async () => {
+    queueWhereResponses([[]])
+    mockCreatePendingInvitation.mockResolvedValueOnce({
+      invitationId: 'inv-2',
+      token: 'tok-2',
+      expiresAt: new Date(),
+      created: true,
+      addedWorkspaceIds: ['ws-1', 'ws-2'],
+      grants: [
+        { workspaceId: 'ws-1', permission: 'write' },
+        { workspaceId: 'ws-2', permission: 'write' },
+      ],
+    })
+
+    const result = await createWorkspaceInvitation({
+      context: makeContext(['ws-1', 'ws-2']),
+      email: 'new@example.com',
+      permission: 'write',
+      request,
+    })
+
+    expect(result.workspaceIds).toEqual(['ws-1', 'ws-2'])
+    expect(mockCreatePendingInvitation).toHaveBeenCalledTimes(1)
+    expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
+      expect.objectContaining({
+        grants: [
+          { workspaceId: 'ws-1', permission: 'write' },
+          { workspaceId: 'ws-2', permission: 'write' },
+        ],
+      })
+    )
+    expect(mockSendInvitationEmail).toHaveBeenCalledTimes(1)
+  })
+
+  it('drops workspaces already covered by a pending invitation instead of failing', async () => {
+    queueWhereResponses([[]])
+    mockFindPendingGrantWorkspaceIds.mockResolvedValueOnce(new Set(['ws-1']))
+
+    await createWorkspaceInvitation({
+      context: makeContext(['ws-1', 'ws-2']),
+      email: 'new@example.com',
+      permission: 'write',
+      request,
+    })
+
+    expect(mockCreatePendingInvitation).toHaveBeenCalledWith(
+      expect.objectContaining({ grants: [{ workspaceId: 'ws-2', permission: 'write' }] })
+    )
+  })
+
+  it('rejects when every selected workspace is already invited', async () => {
+    queueWhereResponses([[]])
+    mockFindPendingGrantWorkspaceIds.mockResolvedValueOnce(new Set(['ws-1', 'ws-2']))
+
+    await expect(
+      createWorkspaceInvitation({
+        context: makeContext(['ws-1', 'ws-2']),
+        email: 'new@example.com',
+        permission: 'write',
+        request,
+      })
+    ).rejects.toThrow('has already been invited')
+  })
+
+  it('reverts only the added grants when a merged invitation fails to send', async () => {
+    queueWhereResponses([[]])
+    mockCreatePendingInvitation.mockResolvedValueOnce({
+      invitationId: 'inv-existing',
+      token: 'tok-existing',
+      expiresAt: new Date(),
+      created: false,
+      addedWorkspaceIds: ['ws-2'],
+      grants: [
+        { workspaceId: 'ws-1', permission: 'write' },
+        { workspaceId: 'ws-2', permission: 'write' },
+      ],
+    })
+    mockSendInvitationEmail.mockResolvedValueOnce({ success: false, error: 'smtp down' })
+
+    await expect(
+      createWorkspaceInvitation({
+        context: makeContext(['ws-2']),
+        email: 'new@example.com',
+        permission: 'write',
+        request,
+      })
+    ).rejects.toThrow('smtp down')
+
+    expect(mockCancelPendingInvitation).not.toHaveBeenCalled()
+    expect(mockRevertPendingInvitationGrants).toHaveBeenCalledWith({
+      invitationId: 'inv-existing',
+      workspaceIds: ['ws-2'],
+    })
+  })
 })
diff --git a/apps/sim/lib/invitations/workspace-invitations.ts b/apps/sim/lib/invitations/workspace-invitations.ts
index 517a0063644..59339eef5b9 100644
--- a/apps/sim/lib/invitations/workspace-invitations.ts
+++ b/apps/sim/lib/invitations/workspace-invitations.ts
@@ -2,19 +2,23 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { type InvitationMembershipIntent, permissions, user } from '@sim/db/schema'
 import { normalizeEmail } from '@sim/utils/string'
-import { and, eq, sql } from 'drizzle-orm'
+import { and, eq, inArray, sql } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
+import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import { getUserOrganization } from '@/lib/billing/organizations/membership'
 import { validateSeatAvailability } from '@/lib/billing/validation/seat-management'
+import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import {
   type DirectGrantOutcome,
   grantWorkspaceAccessDirectly,
 } from '@/lib/invitations/direct-grant'
 import {
+  ConflictingPendingInvitationError,
   cancelPendingInvitation,
   createPendingInvitation,
-  findPendingGrantForWorkspaceEmail,
+  findPendingGrantWorkspaceIds,
+  revertPendingInvitationGrants,
   sendInvitationEmail,
 } from '@/lib/invitations/send'
 import { captureServerEvent } from '@/lib/posthog/server'
@@ -24,25 +28,43 @@ import {
   type PermissionType,
   type WorkspaceWithOwner,
 } from '@/lib/workspaces/permissions/utils'
-import { getWorkspaceInvitePolicy, type WorkspaceInvitePolicy } from '@/lib/workspaces/policy'
+import {
+  getInvitePlanCategoryForUser,
+  getWorkspaceInvitePolicy,
+  type WorkspaceInvitePolicy,
+} from '@/lib/workspaces/policy'
 import { validateInvitationsAllowed } from '@/ee/access-control/utils/permission-check'
 
-export interface WorkspaceInvitationContext {
+/**
+ * What the invitee becomes in the organization. `member` and `admin` are
+ * organization roles and consume a seat; `external` grants the workspaces only.
+ */
+export type InvitationMembership = 'member' | 'admin' | 'external'
+
+/** One authorized target workspace of an invitation. */
+export interface WorkspaceInvitationTarget {
   workspaceId: string
+  workspaceDetails: WorkspaceWithOwner
+  invitePolicy: WorkspaceInvitePolicy
+}
+
+export interface WorkspaceInvitationContext {
   inviterId: string
   inviterName: string
   inviterEmail?: string | null
-  workspaceDetails: WorkspaceWithOwner
-  invitePolicy: WorkspaceInvitePolicy
+  /** Every target shares one organization scope; see `prepareWorkspaceInvitationContext`. */
+  targets: WorkspaceInvitationTarget[]
+  /** The organization all targets belong to, or null for a personal workspace. */
+  organizationId: string | null
 }
 
 export interface WorkspaceInvitationResult {
   id: string
-  workspaceId: string
   email: string
+  /** Workspaces this call granted or invited to; excludes ones already covered. */
+  workspaceIds: string[]
   permission: PermissionType
   membershipIntent: InvitationMembershipIntent
-  expiresAt: Date | undefined
   /** True when the user was granted access directly (no pending invitation). */
   instantAdd?: boolean
   /** Direct-grant outcome when `instantAdd` is true. */
@@ -73,59 +95,130 @@ export class WorkspaceInvitationError extends Error {
   }
 }
 
+/**
+ * Authorizes the inviter on every target workspace and resolves the shared
+ * organization scope. Mixing scopes is rejected: one invitation carries one
+ * organization stamp, and a personal workspace has none to give.
+ */
 export async function prepareWorkspaceInvitationContext({
-  workspaceId,
+  workspaceIds,
   inviterId,
   inviterName,
   inviterEmail,
 }: {
-  workspaceId: string
+  workspaceIds: string[]
   inviterId: string
   inviterName: string
   inviterEmail?: string | null
 }): Promise<WorkspaceInvitationContext> {
-  await validateInvitationsAllowed(inviterId, workspaceId)
+  const uniqueWorkspaceIds = [...new Set(workspaceIds)]
+  if (uniqueWorkspaceIds.length === 0) {
+    throw new WorkspaceInvitationError({ message: 'Select at least one workspace', status: 400 })
+  }
+
+  const targets: WorkspaceInvitationTarget[] = []
+  for (const workspaceId of uniqueWorkspaceIds) {
+    await validateInvitationsAllowed(inviterId, workspaceId)
+
+    const isAdmin = await hasWorkspaceAdminAccess(inviterId, workspaceId)
+    if (!isAdmin) {
+      throw new WorkspaceInvitationError({
+        message: 'You need admin permissions to invite users',
+        status: 403,
+      })
+    }
+
+    const workspaceDetails = await getWorkspaceWithOwner(workspaceId)
+    if (!workspaceDetails) {
+      throw new WorkspaceInvitationError({ message: 'Workspace not found', status: 404 })
+    }
+
+    const invitePolicy = await getWorkspaceInvitePolicy(workspaceDetails)
+    if (!invitePolicy.allowed) {
+      throw new WorkspaceInvitationError({
+        message: invitePolicy.reason ?? 'Invites are disabled for this workspace.',
+        status: 403,
+        upgradeRequired: invitePolicy.upgradeRequired,
+      })
+    }
 
-  const isAdmin = await hasWorkspaceAdminAccess(inviterId, workspaceId)
-  if (!isAdmin) {
+    targets.push({ workspaceId, workspaceDetails, invitePolicy })
+  }
+
+  const organizationId = targets[0].workspaceDetails.organizationId
+  if (targets.some((target) => target.workspaceDetails.organizationId !== organizationId)) {
     throw new WorkspaceInvitationError({
-      message: 'You need admin permissions to invite users',
-      status: 403,
+      message: 'Select workspaces from a single organization',
+      status: 400,
     })
   }
-
-  const workspaceDetails = await getWorkspaceWithOwner(workspaceId)
-  if (!workspaceDetails) {
-    throw new WorkspaceInvitationError({ message: 'Workspace not found', status: 404 })
+  if (!organizationId && targets.length > 1) {
+    throw new WorkspaceInvitationError({
+      message: 'Personal workspaces can only be invited to one at a time',
+      status: 400,
+    })
   }
 
-  const invitePolicy = await getWorkspaceInvitePolicy(workspaceDetails)
-  if (!invitePolicy.allowed) {
+  return { inviterId, inviterName, inviterEmail, targets, organizationId }
+}
+
+/**
+ * Throws the invite-flow seat error when the organization cannot take one
+ * more internal member.
+ */
+async function assertSeatAvailable(organizationId: string, email: string): Promise<void> {
+  const seatValidation = await validateSeatAvailability(organizationId, 1)
+  if (!seatValidation.canInvite) {
     throw new WorkspaceInvitationError({
-      message: invitePolicy.reason ?? 'Invites are disabled for this workspace.',
-      status: 403,
-      upgradeRequired: invitePolicy.upgradeRequired,
+      message: seatValidation.reason || 'No available seats for this organization.',
+      status: 400,
+      email,
     })
   }
-  return {
-    workspaceId,
-    inviterId,
-    inviterName,
-    inviterEmail,
-    workspaceDetails,
-    invitePolicy,
-  }
 }
 
+/**
+ * External collaborators hold workspace access without consuming a seat, so
+ * the economics only work when the invitee already pays Sim somewhere else —
+ * their own Pro/Max plan, or an organization that seats them. Admitting a free
+ * account as external would be unmetered platform access nobody pays for, so
+ * they must be invited as a Member or Admin instead.
+ */
+async function inviteeCanBeExternal(userId: string | undefined): Promise<boolean> {
+  /**
+   * The requirement exists because an external collaborator consumes no seat, so
+   * somebody else must be paying for them. With billing disabled there are no
+   * seats and no subscriptions at all — every account resolves as `free` — so
+   * enforcing it would leave a self-hosted deployment no way to grant
+   * workspace-only access without an organization join and a workspace sweep.
+   */
+  if (!isBillingEnabled) return true
+  if (!userId) return false
+  return (await getInvitePlanCategoryForUser(userId)) !== 'free'
+}
+
+/**
+ * Invites one person to every workspace in the context they do not already
+ * have (or already have a pending invitation for), as a single invitation with
+ * one grant per workspace and one email.
+ */
 export async function createWorkspaceInvitation({
   context,
   email,
   permission = 'read',
+  membership = 'member',
   request,
 }: {
   context: WorkspaceInvitationContext
   email: string
   permission?: string
+  /**
+   * The inviter's choice of what the invitee becomes. `external` is rejected
+   * for free accounts and on personal workspaces; it is also applied
+   * automatically, whatever was asked for, when the invitee already belongs to
+   * a different organization — Sim accounts belong to at most one.
+   */
+  membership?: InvitationMembership
   request: NextRequest
 }): Promise<WorkspaceInvitationResult> {
   const validPermissions: PermissionType[] = ['admin', 'write', 'read']
@@ -137,175 +230,254 @@ export async function createWorkspaceInvitation({
     })
   }
   const invitationPermission = permission as PermissionType
-
   const normalizedEmail = normalizeEmail(email)
-  let membershipIntent: InvitationMembershipIntent = 'internal'
+  const organizationId = context.organizationId
+  const allWorkspaceIds = context.targets.map((target) => target.workspaceId)
 
   const existingUser = await db
-    .select()
+    .select({ id: user.id })
     .from(user)
     .where(sql`lower(${user.email}) = ${normalizedEmail}`)
     .then((rows) => rows[0])
 
-  if (existingUser) {
-    const workspaceOrganizationId = context.workspaceDetails.organizationId
-    const existingMembership = workspaceOrganizationId
-      ? await getUserOrganization(existingUser.id)
-      : null
+  const existingMembership =
+    existingUser && organizationId ? await getUserOrganization(existingUser.id) : null
 
-    const existingPermission = await db
-      .select()
+  let pendingTargets = context.targets
+  if (existingUser) {
+    const accessibleRows = await db
+      .select({ workspaceId: permissions.entityId })
       .from(permissions)
       .where(
         and(
-          eq(permissions.entityId, context.workspaceId),
           eq(permissions.entityType, 'workspace'),
-          eq(permissions.userId, existingUser.id)
+          eq(permissions.userId, existingUser.id),
+          inArray(permissions.entityId, allWorkspaceIds)
         )
       )
-      .then((rows) => rows[0])
+    const accessibleWorkspaceIds = new Set(accessibleRows.map((row) => row.workspaceId))
 
     /**
-     * Already a workspace member: reject. Invites never change an existing
-     * member's permission — role changes go through the members list, not the
-     * invite flow. (The client also blocks re-inviting current teammates.)
+     * Invites never change an existing member's permission — role changes go
+     * through the members list — so workspaces they already hold are dropped
+     * rather than failing the whole invitation.
      */
-    if (existingPermission) {
+    pendingTargets = context.targets.filter(
+      (target) => !accessibleWorkspaceIds.has(target.workspaceId)
+    )
+    if (pendingTargets.length === 0) {
       throw new WorkspaceInvitationError({
-        message: `${normalizedEmail} already has access to this workspace`,
+        message: `${normalizedEmail} already has access to ${
+          context.targets.length === 1 ? 'this workspace' : 'every selected workspace'
+        }`,
         status: 400,
         email: normalizedEmail,
       })
     }
 
     /**
-     * Invitee already belongs to the workspace's organization (and is not yet a
-     * member of this workspace): grant access directly, with no invitation or
-     * acceptance step.
+     * Already in this organization: they hold a seat, so grant access directly
+     * with no invitation or acceptance step.
      */
-    if (
-      workspaceOrganizationId &&
-      existingMembership &&
-      existingMembership.organizationId === workspaceOrganizationId
-    ) {
-      const directGrant = await grantWorkspaceAccessDirectly({
-        userId: existingUser.id,
-        email: normalizedEmail,
-        workspaceId: context.workspaceId,
-        workspaceName: context.workspaceDetails.name,
-        permission: invitationPermission,
-        organizationId: workspaceOrganizationId,
-        actorId: context.inviterId,
-        actorName: context.inviterName,
-        actorEmail: context.inviterEmail,
-        request,
-      })
+    if (organizationId && existingMembership?.organizationId === organizationId) {
+      let outcome: DirectGrantOutcome['outcome'] = 'unchanged'
+      for (const target of pendingTargets) {
+        const directGrant = await grantWorkspaceAccessDirectly({
+          userId: existingUser.id,
+          email: normalizedEmail,
+          workspaceId: target.workspaceId,
+          workspaceName: target.workspaceDetails.name,
+          permission: invitationPermission,
+          organizationId,
+          actorId: context.inviterId,
+          actorName: context.inviterName,
+          actorEmail: context.inviterEmail,
+          request,
+        })
+        if (directGrant.outcome === 'added') outcome = 'added'
+      }
 
       return {
         id: existingUser.id,
-        workspaceId: context.workspaceId,
         email: normalizedEmail,
+        workspaceIds: pendingTargets.map((target) => target.workspaceId),
         permission: invitationPermission,
         membershipIntent: 'internal',
-        expiresAt: undefined,
         instantAdd: true,
-        outcome: directGrant.outcome,
+        outcome,
       }
     }
+  }
 
-    if (workspaceOrganizationId) {
-      if (existingMembership && existingMembership.organizationId !== workspaceOrganizationId) {
-        membershipIntent = 'external'
-      } else if (context.invitePolicy.requiresSeat && !existingMembership) {
-        const seatValidation = await validateSeatAvailability(workspaceOrganizationId, 1)
-        if (!seatValidation.canInvite) {
-          throw new WorkspaceInvitationError({
-            message: seatValidation.reason || 'No available seats for this organization.',
-            status: 400,
-            email: normalizedEmail,
-          })
-        }
-      }
+  /**
+   * An invitee who already belongs to a different organization cannot join
+   * this one, so the invitation becomes external whatever the inviter chose.
+   */
+  const forcedExternal = Boolean(
+    organizationId && existingMembership && existingMembership.organizationId !== organizationId
+  )
+
+  let membershipIntent: InvitationMembershipIntent = 'internal'
+  if (forcedExternal) {
+    membershipIntent = 'external'
+  } else if (membership === 'external') {
+    if (!organizationId) {
+      throw new WorkspaceInvitationError({
+        message: 'External collaborators are only available on organization workspaces.',
+        status: 400,
+        email: normalizedEmail,
+      })
     }
-  } else if (context.invitePolicy.requiresSeat && context.invitePolicy.organizationId) {
-    const seatValidation = await validateSeatAvailability(context.invitePolicy.organizationId, 1)
-    if (!seatValidation.canInvite) {
+    if (!(await inviteeCanBeExternal(existingUser?.id))) {
       throw new WorkspaceInvitationError({
-        message: seatValidation.reason || 'No available seats for this organization.',
+        message: `${normalizedEmail} is not on a paid Sim plan, so they cannot be added as an external collaborator. Invite them as a Member or Admin instead — that adds a seat.`,
         status: 400,
         email: normalizedEmail,
       })
     }
+    membershipIntent = 'external'
+  }
+
+  /**
+   * Granting organization Admin is an organization-level act: an org admin holds
+   * admin on every workspace the org owns and can manage members, roles, and
+   * billing. Workspace admin authority must not escalate into it, so the inviter
+   * has to already hold it. Checked here rather than in the modal because the
+   * modal is only the UI — the batch endpoint is reachable directly.
+   */
+  if (membershipIntent === 'internal' && membership === 'admin') {
+    if (!organizationId || !(await isOrganizationOwnerOrAdmin(context.inviterId, organizationId))) {
+      throw new WorkspaceInvitationError({
+        message:
+          'Only an organization owner or admin can invite someone as an organization admin. Invite them as a Member instead.',
+        status: 403,
+        email: normalizedEmail,
+      })
+    }
+  }
+
+  const role: 'admin' | 'member' =
+    membershipIntent === 'internal' && membership === 'admin' ? 'admin' : 'member'
+
+  /**
+   * Only internal invitees take a seat, and only Enterprise reserves one at
+   * invite time (`requiresSeat`) — Team seats are provisioned on acceptance.
+   */
+  if (
+    membershipIntent === 'internal' &&
+    organizationId &&
+    context.targets[0].invitePolicy.requiresSeat
+  ) {
+    await assertSeatAvailable(organizationId, normalizedEmail)
   }
 
-  const existingInvitation = await findPendingGrantForWorkspaceEmail({
-    workspaceId: context.workspaceId,
+  /**
+   * Workspaces already covered by a pending invitation are dropped so the
+   * remaining ones still go out; re-inviting to only those is the duplicate.
+   */
+  const alreadyPendingWorkspaceIds = await findPendingGrantWorkspaceIds({
+    workspaceIds: pendingTargets.map((target) => target.workspaceId),
     email: normalizedEmail,
   })
-  if (existingInvitation) {
+  const newTargets = pendingTargets.filter(
+    (target) => !alreadyPendingWorkspaceIds.has(target.workspaceId)
+  )
+  if (newTargets.length === 0) {
     throw new WorkspaceInvitationError({
-      message: `${normalizedEmail} has already been invited to this workspace`,
+      message: `${normalizedEmail} has already been invited to ${
+        pendingTargets.length === 1 ? 'this workspace' : 'every selected workspace'
+      }`,
       status: 400,
       email: normalizedEmail,
     })
   }
+  const newWorkspaceIds = newTargets.map((target) => target.workspaceId)
 
-  const { invitationId, token } = await createPendingInvitation({
-    kind: 'workspace',
-    email: normalizedEmail,
-    inviterId: context.inviterId,
-    organizationId: context.workspaceDetails.organizationId,
-    membershipIntent,
-    role: 'member',
-    grants: [
-      {
-        workspaceId: context.workspaceId,
-        permission: invitationPermission,
-      },
-    ],
-  })
-
+  let invitationRecord: Awaited<ReturnType<typeof createPendingInvitation>>
   try {
-    PlatformEvents.workspaceMemberInvited({
-      workspaceId: context.workspaceId,
-      invitedBy: context.inviterId,
-      inviteeEmail: normalizedEmail,
-      role: invitationPermission,
+    invitationRecord = await createPendingInvitation({
+      kind: 'workspace',
+      email: normalizedEmail,
+      inviterId: context.inviterId,
+      organizationId,
       membershipIntent,
+      role,
+      grants: newTargets.map((target) => ({
+        workspaceId: target.workspaceId,
+        permission: invitationPermission,
+      })),
     })
-  } catch {
+  } catch (error) {
     /**
-     * Telemetry must not fail invitation creation.
+     * The new workspaces would merge into a pending invitation granting a
+     * different standing; surface it to the inviter instead of silently
+     * picking one.
      */
+    if (error instanceof ConflictingPendingInvitationError) {
+      throw new WorkspaceInvitationError({
+        message: error.message,
+        status: 400,
+        email: normalizedEmail,
+      })
+    }
+    throw error
   }
 
-  captureServerEvent(
-    context.inviterId,
-    'workspace_member_invited',
-    {
-      workspace_id: context.workspaceId,
-      invitee_role: invitationPermission,
-      membership_intent: membershipIntent,
-    },
-    {
-      groups: { workspace: context.workspaceId },
-      setOnce: { first_invitation_sent_at: new Date().toISOString() },
+  const invitedAt = new Date().toISOString()
+  for (const target of newTargets) {
+    try {
+      PlatformEvents.workspaceMemberInvited({
+        workspaceId: target.workspaceId,
+        invitedBy: context.inviterId,
+        inviteeEmail: normalizedEmail,
+        role: invitationPermission,
+        membershipIntent,
+      })
+    } catch {
+      /**
+       * Telemetry must not fail invitation creation.
+       */
     }
-  )
 
+    captureServerEvent(
+      context.inviterId,
+      'workspace_member_invited',
+      {
+        workspace_id: target.workspaceId,
+        invitee_role: invitationPermission,
+        membership_intent: membershipIntent,
+      },
+      {
+        groups: { workspace: target.workspaceId },
+        setOnce: { first_invitation_sent_at: invitedAt },
+      }
+    )
+  }
+
+  /**
+   * The email covers every workspace the invitation now grants, including ones
+   * merged in from an earlier invite, so one link explains all of them.
+   */
   const emailResult = await sendInvitationEmail({
-    invitationId,
-    token,
+    invitationId: invitationRecord.invitationId,
+    token: invitationRecord.token,
     kind: 'workspace',
     email: normalizedEmail,
     inviterName: context.inviterName,
-    organizationId: context.workspaceDetails.organizationId,
-    organizationRole: 'member',
-    grants: [{ workspaceId: context.workspaceId, permission: invitationPermission }],
+    organizationId,
+    organizationRole: role,
+    grants: invitationRecord.grants,
   })
 
   if (!emailResult.success) {
-    await cancelPendingInvitation(invitationId)
+    if (invitationRecord.created) {
+      await cancelPendingInvitation(invitationRecord.invitationId)
+    } else {
+      await revertPendingInvitationGrants({
+        invitationId: invitationRecord.invitationId,
+        workspaceIds: invitationRecord.addedWorkspaceIds,
+      })
+    }
     throw new WorkspaceInvitationError({
       message: emailResult.error || 'Failed to send invitation email',
       status: 502,
@@ -313,32 +485,34 @@ export async function createWorkspaceInvitation({
     })
   }
 
-  recordAudit({
-    workspaceId: context.workspaceId,
-    actorId: context.inviterId,
-    actorName: context.inviterName,
-    actorEmail: context.inviterEmail,
-    action: AuditAction.MEMBER_INVITED,
-    resourceType: AuditResourceType.WORKSPACE,
-    resourceId: context.workspaceId,
-    resourceName: normalizedEmail,
-    description: `Invited ${normalizedEmail} as ${invitationPermission}`,
-    metadata: {
-      targetEmail: normalizedEmail,
-      targetRole: invitationPermission,
-      membershipIntent,
-      workspaceName: context.workspaceDetails.name,
-      invitationId,
-    },
-    request,
-  })
+  for (const target of newTargets) {
+    recordAudit({
+      workspaceId: target.workspaceId,
+      actorId: context.inviterId,
+      actorName: context.inviterName,
+      actorEmail: context.inviterEmail,
+      action: AuditAction.MEMBER_INVITED,
+      resourceType: AuditResourceType.WORKSPACE,
+      resourceId: target.workspaceId,
+      resourceName: normalizedEmail,
+      description: `Invited ${normalizedEmail} as ${invitationPermission}`,
+      metadata: {
+        targetEmail: normalizedEmail,
+        targetRole: invitationPermission,
+        membershipIntent,
+        organizationRole: role,
+        workspaceName: target.workspaceDetails.name,
+        invitationId: invitationRecord.invitationId,
+      },
+      request,
+    })
+  }
 
   return {
-    id: invitationId,
-    workspaceId: context.workspaceId,
+    id: invitationRecord.invitationId,
     email: normalizedEmail,
+    workspaceIds: newWorkspaceIds,
     permission: invitationPermission,
     membershipIntent,
-    expiresAt: undefined,
   }
 }
diff --git a/apps/sim/lib/workspaces/admin-move.test.ts b/apps/sim/lib/workspaces/admin-move.test.ts
index d1e29fffbdc..a9572771c9e 100644
--- a/apps/sim/lib/workspaces/admin-move.test.ts
+++ b/apps/sim/lib/workspaces/admin-move.test.ts
@@ -127,15 +127,13 @@ describe('classifyWorkspaceMoveState', () => {
     )
   })
 
-  it('keeps archived personal workspaces ineligible for a new move', () => {
-    expect(() =>
+  it('keeps archived personal workspaces movable so they cannot dodge organization purview', () => {
+    expect(
       classifyWorkspaceMoveState(
         { workspaceMode: WORKSPACE_MODE.PERSONAL, organizationId: null, archivedAt: new Date() },
         'org-1'
       )
-    ).toThrowError(
-      expect.objectContaining<Partial<WorkspaceMoveError>>({ code: 'workspace-archived' })
-    )
+    ).toBe('move')
   })
 })
 
diff --git a/apps/sim/lib/workspaces/admin-move.ts b/apps/sim/lib/workspaces/admin-move.ts
index ea17d7c8635..fa6243fdaad 100644
--- a/apps/sim/lib/workspaces/admin-move.ts
+++ b/apps/sim/lib/workspaces/admin-move.ts
@@ -39,7 +39,6 @@ export class WorkspaceMoveError extends Error {
     readonly code:
       | 'workspace-not-found'
       | 'organization-not-found'
-      | 'workspace-archived'
       | 'already-organization-workspace'
   ) {
     super(message)
@@ -56,6 +55,8 @@ export interface WorkspaceMoveCandidate {
   workspaceMode: string
   organizationId: string | null
   billedAccountUserId: string
+  /** Archived workspaces are movable; surfaced so admin UIs can label them. */
+  archived: boolean
 }
 
 export interface WorkspaceMovePreflight {
@@ -124,7 +125,7 @@ export async function searchWorkspaceMoveCandidates(
   const query = search.trim()
   if (!query) return []
 
-  return db
+  const rows = await db
     .select({
       id: workspace.id,
       name: workspace.name,
@@ -134,18 +135,20 @@ export async function searchWorkspaceMoveCandidates(
       workspaceMode: workspace.workspaceMode,
       organizationId: workspace.organizationId,
       billedAccountUserId: workspace.billedAccountUserId,
+      archivedAt: workspace.archivedAt,
     })
     .from(workspace)
     .innerJoin(user, eq(user.id, workspace.ownerId))
     .where(
       and(
-        isNull(workspace.archivedAt),
         ne(workspace.workspaceMode, WORKSPACE_MODE.ORGANIZATION),
         or(eq(workspace.id, query), ilike(workspace.name, `%${query}%`))
       )
     )
     .orderBy(asc(workspace.name))
     .limit(Math.min(Math.max(limit, 1), 50))
+
+  return rows.map(({ archivedAt, ...row }) => ({ ...row, archived: archivedAt !== null }))
 }
 
 /** Builds the human-reviewable summary shown before a workspace move. */
@@ -437,7 +440,7 @@ export async function moveWorkspaceToOrganization(params: {
 }
 
 async function searchWorkspaceById(workspaceId: string): Promise<WorkspaceMoveCandidate[]> {
-  return db
+  const rows = await db
     .select({
       id: workspace.id,
       name: workspace.name,
@@ -453,12 +456,16 @@ async function searchWorkspaceById(workspaceId: string): Promise<WorkspaceMoveCa
     .innerJoin(user, eq(user.id, workspace.ownerId))
     .where(eq(workspace.id, workspaceId))
     .limit(1)
+
+  return rows.map(({ archivedAt, ...row }) => ({ ...row, archived: archivedAt !== null }))
 }
 
+/**
+ * Archived workspaces are deliberately movable: leaving them behind keeps an
+ * unarchive-later escape hatch outside the organization's purview, and
+ * join-attach already sweeps them (`includeArchived`).
+ */
 function assertWorkspaceMovable(row: { archivedAt?: Date | null; workspaceMode: string }): void {
-  if (row.archivedAt) {
-    throw new WorkspaceMoveError('Archived workspaces cannot be moved', 'workspace-archived')
-  }
   if (row.workspaceMode === WORKSPACE_MODE.ORGANIZATION) {
     throw new WorkspaceMoveError(
       'Inter-organization workspace transfers are not supported',
@@ -876,7 +883,7 @@ async function getMovedWorkspaceSummary(
   workspaceId: string,
   destination: WorkspaceMoveDestination
 ): Promise<WorkspaceMovePreflight> {
-  const [workspaceRow] = await executor
+  const [movedRow] = await executor
     .select({
       id: workspace.id,
       name: workspace.name,
@@ -886,14 +893,20 @@ async function getMovedWorkspaceSummary(
       workspaceMode: workspace.workspaceMode,
       organizationId: workspace.organizationId,
       billedAccountUserId: workspace.billedAccountUserId,
+      archivedAt: workspace.archivedAt,
     })
     .from(workspace)
     .innerJoin(user, eq(user.id, workspace.ownerId))
     .where(eq(workspace.id, workspaceId))
     .limit(1)
-  if (!workspaceRow) {
+  if (!movedRow) {
     throw new WorkspaceMoveError('Moved workspace could not be reloaded', 'workspace-not-found')
   }
+  const { archivedAt, ...movedWorkspace } = movedRow
+  const workspaceRow: WorkspaceMoveCandidate = {
+    ...movedWorkspace,
+    archived: archivedAt !== null,
+  }
 
   const collaboratorRows = await executor
     .select({
diff --git a/apps/sim/lib/workspaces/organization-workspaces.test.ts b/apps/sim/lib/workspaces/organization-workspaces.test.ts
index 2dd1bcb4800..43b5fe564ef 100644
--- a/apps/sim/lib/workspaces/organization-workspaces.test.ts
+++ b/apps/sim/lib/workspaces/organization-workspaces.test.ts
@@ -218,6 +218,34 @@ describe('organization workspace helpers', () => {
     expect(dbChainMockFns.update).toHaveBeenCalled()
   })
 
+  it('attaches an archived workspace without joining its collaborators', async () => {
+    queueTableRows(schemaMock.workspace, [{ id: 'ws-archived' }])
+    queueTableRows(schemaMock.workspace, [{ id: 'ws-archived' }])
+    queueTableRows(schemaMock.workspace, [
+      {
+        id: 'ws-archived',
+        billedAccountUserId: 'user-1',
+        organizationId: null,
+        archivedAt: new Date(),
+      },
+    ])
+    queueTableRows(schemaMock.member, [{ userId: 'owner-1' }])
+    dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'ws-archived' }])
+
+    const result = await attachOwnedWorkspacesToOrganization({
+      ownerUserId: 'user-1',
+      organizationId: 'org-1',
+      externalMemberPolicy: 'keep-external',
+      includeArchived: true,
+    })
+
+    // Purview: the archived workspace still moves into the organization…
+    expect(result.attachedWorkspaceIds).toEqual(['ws-archived'])
+    // …but nobody is joined (and no seat consumed) off the back of it.
+    expect(mockEnsureUserInOrganizationTx).not.toHaveBeenCalled()
+    expect(result.addedMemberIds).toEqual([])
+  })
+
   it('rolls back membership work when a concurrent move wins before the locked re-read', async () => {
     queueTableRows(schemaMock.workspace, [{ id: 'ws-1' }])
     queueTableRows(schemaMock.workspace, [{ id: 'ws-1' }])
diff --git a/apps/sim/lib/workspaces/organization-workspaces.ts b/apps/sim/lib/workspaces/organization-workspaces.ts
index 3d51f1a88c0..c6ab1fac739 100644
--- a/apps/sim/lib/workspaces/organization-workspaces.ts
+++ b/apps/sim/lib/workspaces/organization-workspaces.ts
@@ -49,14 +49,49 @@ export class WorkspaceOrganizationMembershipConflictError extends Error {
 }
 
 /**
- * How to treat workspace members that already belong to a *different*
+ * How to treat workspace collaborators that are not members of the target
  * organization when attaching workspaces:
- *   - `reject` (default): throw a conflict — used by manual org creation.
- *   - `keep-external`: skip them (they stay external workspace members) and
- *     attach anyway — used by the Pro→Team conversion, which must not abort
- *     just because a personal workspace already has an external collaborator.
+ *   - `reject` (default): throw a conflict when any collaborator belongs to a
+ *     *different* organization — used by manual org creation.
+ *   - `keep-external`: collaborators in a *different* organization stay
+ *     external workspace members and the attach proceeds; org-less
+ *     collaborators are joined into the organization — used by the Pro→Team
+ *     conversion, which must not abort just because a personal workspace
+ *     already has an external collaborator.
+ *   - `external-all`: nobody joins the organization as a side effect — every
+ *     collaborator who is not already a member stays an external workspace
+ *     member. Used when a joining member's owned workspaces follow them into
+ *     the organization: membership (and its seat) only ever comes from an
+ *     invitation the person accepted or an explicit admin action.
  */
-type ExternalMemberPolicy = 'reject' | 'keep-external'
+type ExternalMemberPolicy = 'reject' | 'keep-external' | 'external-all'
+
+/**
+ * The single definition of "a workspace that follows this user into an
+ * organization": owned (or billed) by them, not yet organization-owned, and —
+ * unless `includeArchived` — not archived. Every site that selects, locks, or
+ * previews attachable workspaces must build its WHERE from this so the
+ * acceptance lock plan, the attach queries, and the accept-screen preview can
+ * never drift apart.
+ */
+export function ownedAttachableWorkspacesWhere({
+  userId,
+  ownerMatch = 'owner',
+  includeArchived = false,
+}: {
+  userId: string
+  ownerMatch?: 'owner' | 'billing-account'
+  includeArchived?: boolean
+}) {
+  return and(
+    ownerMatch === 'owner'
+      ? eq(workspace.ownerId, userId)
+      : eq(workspace.billedAccountUserId, userId),
+    isNull(workspace.organizationId),
+    ne(workspace.workspaceMode, WORKSPACE_MODE.ORGANIZATION),
+    ...(includeArchived ? [] : [isNull(workspace.archivedAt)])
+  )
+}
 
 /**
  * Locks workspace rows before any membership billing path can lock user or
@@ -76,24 +111,23 @@ interface AttachOwnedWorkspacesToOrganizationParams {
   ownerUserId: string
   organizationId: string
   externalMemberPolicy?: ExternalMemberPolicy
+  /**
+   * Also attach archived workspaces. Join-attach sweeps them so unarchiving
+   * later can never resurface a personal workspace outside the organization.
+   */
+  includeArchived?: boolean
 }
 
 export async function attachOwnedWorkspacesToOrganization({
   ownerUserId,
   organizationId,
   externalMemberPolicy = 'reject',
+  includeArchived = false,
 }: AttachOwnedWorkspacesToOrganizationParams): Promise<AttachOwnedWorkspacesToOrganizationResult> {
   const ownedWorkspaces = await db
     .select({ id: workspace.id })
     .from(workspace)
-    .where(
-      and(
-        eq(workspace.ownerId, ownerUserId),
-        isNull(workspace.organizationId),
-        ne(workspace.workspaceMode, WORKSPACE_MODE.ORGANIZATION),
-        isNull(workspace.archivedAt)
-      )
-    )
+    .where(ownedAttachableWorkspacesWhere({ userId: ownerUserId, includeArchived }))
   const ownedWorkspaceIds = ownedWorkspaces.map((ownedWorkspace) => ownedWorkspace.id)
   if (ownedWorkspaceIds.length === 0) {
     return { attachedWorkspaceIds: [], addedMemberIds: [], skippedMembers: [] }
@@ -115,6 +149,7 @@ export async function attachOwnedWorkspacesToOrganization({
       workspaceIds: ownedWorkspaceIds,
       externalMemberPolicy,
       ownerMatch: 'owner',
+      includeArchived,
     })
   })
 
@@ -167,12 +202,14 @@ export async function attachOwnedWorkspacesToOrganizationTx(
     workspaceIds,
     externalMemberPolicy = 'keep-external',
     ownerMatch = 'billing-account',
+    includeArchived = false,
   }: {
     ownerUserId: string
     organizationId: string
     workspaceIds: string[]
     externalMemberPolicy?: ExternalMemberPolicy
     ownerMatch?: 'owner' | 'billing-account'
+    includeArchived?: boolean
   }
 ): Promise<AttachOwnedWorkspacesToOrganizationTxResult> {
   if (workspaceIds.length === 0) {
@@ -192,17 +229,13 @@ export async function attachOwnedWorkspacesToOrganizationTx(
       id: workspace.id,
       billedAccountUserId: workspace.billedAccountUserId,
       organizationId: workspace.organizationId,
+      archivedAt: workspace.archivedAt,
     })
     .from(workspace)
     .where(
       and(
-        ownerMatch === 'owner'
-          ? eq(workspace.ownerId, ownerUserId)
-          : eq(workspace.billedAccountUserId, ownerUserId),
-        inArray(workspace.id, workspaceIds),
-        isNull(workspace.organizationId),
-        ne(workspace.workspaceMode, WORKSPACE_MODE.ORGANIZATION),
-        isNull(workspace.archivedAt)
+        ownedAttachableWorkspacesWhere({ userId: ownerUserId, ownerMatch, includeArchived }),
+        inArray(workspace.id, workspaceIds)
       )
     )
     .orderBy(asc(workspace.id))
@@ -227,12 +260,27 @@ export async function attachOwnedWorkspacesToOrganizationTx(
   }
 
   const ownedWorkspaceIds = ownedWorkspaces.map((row) => row.id)
-  const permissionRows = await tx
-    .select({ userId: permissions.userId })
-    .from(permissions)
-    .where(
-      and(eq(permissions.entityType, 'workspace'), inArray(permissions.entityId, ownedWorkspaceIds))
-    )
+  /**
+   * Collaborators are enumerated from ACTIVE workspaces only. Archived
+   * workspaces still attach (so unarchiving can never dodge the organization),
+   * but sweeping them must not change who becomes a member: a forgotten
+   * collaborator on an archived workspace would otherwise be joined — and
+   * billed as a seat — by an upgrade they had nothing to do with. Anyone
+   * reachable only through an archived workspace stays an external member.
+   */
+  const activeWorkspaceIds = ownedWorkspaces.filter((row) => !row.archivedAt).map((row) => row.id)
+  const permissionRows =
+    activeWorkspaceIds.length > 0
+      ? await tx
+          .select({ userId: permissions.userId })
+          .from(permissions)
+          .where(
+            and(
+              eq(permissions.entityType, 'workspace'),
+              inArray(permissions.entityId, activeWorkspaceIds)
+            )
+          )
+      : []
   const workspaceMemberIds = [...new Set(permissionRows.map((row) => row.userId))].sort()
   const memberships =
     workspaceMemberIds.length > 0
@@ -242,23 +290,34 @@ export async function attachOwnedWorkspacesToOrganizationTx(
           .where(inArray(member.userId, workspaceMemberIds))
       : []
   const membershipByUser = new Map(memberships.map((row) => [row.userId, row.organizationId]))
-  const skippedMembers = workspaceMemberIds
-    .filter((userId) => {
-      const currentOrganizationId = membershipByUser.get(userId)
-      return currentOrganizationId !== undefined && currentOrganizationId !== organizationId
-    })
-    .map((userId) => ({
-      userId,
-      reason: 'Already a member of another organization; kept as external workspace member',
-    }))
-  if (externalMemberPolicy === 'reject' && skippedMembers.length > 0) {
+  const differentOrgMembers = workspaceMemberIds.filter((userId) => {
+    const currentOrganizationId = membershipByUser.get(userId)
+    return currentOrganizationId !== undefined && currentOrganizationId !== organizationId
+  })
+  if (externalMemberPolicy === 'reject' && differentOrgMembers.length > 0) {
     throw new WorkspaceOrganizationMembershipConflictError(
-      skippedMembers.map(({ userId }) => ({
+      differentOrgMembers.map((userId) => ({
         userId,
         organizationId: membershipByUser.get(userId) as string,
       }))
     )
   }
+  const skippedMembers: Array<{ userId: string; reason: string }> = differentOrgMembers.map(
+    (userId) => ({
+      userId,
+      reason: 'Already a member of another organization; kept as external workspace member',
+    })
+  )
+  if (externalMemberPolicy === 'external-all') {
+    for (const userId of workspaceMemberIds) {
+      if (membershipByUser.get(userId) === undefined) {
+        skippedMembers.push({
+          userId,
+          reason: 'Not an organization member; kept as external workspace member',
+        })
+      }
+    }
+  }
   const skippedUserIds = new Set(skippedMembers.map((row) => row.userId))
   const joinableUserIds = workspaceMemberIds.filter((userId) => !skippedUserIds.has(userId))
 
diff --git a/apps/sim/lib/workspaces/policy.test.ts b/apps/sim/lib/workspaces/policy.test.ts
index 7378741cf05..806ede152f8 100644
--- a/apps/sim/lib/workspaces/policy.test.ts
+++ b/apps/sim/lib/workspaces/policy.test.ts
@@ -59,6 +59,58 @@ describe('getWorkspaceCreationPolicy', () => {
     expect(result.currentWorkspaceCount).toBe(1)
   })
 
+  it('blocks a plain member of a lapsed organization from creating anything', async () => {
+    mockGetUserOrganization.mockResolvedValue({
+      organizationId: 'org-1',
+      role: 'member',
+      memberId: 'member-1',
+    })
+    // Cancelled / past_due Team: no usable organization subscription.
+    mockGetOrganizationSubscription.mockResolvedValue({
+      id: 'sub-1',
+      plan: 'team_6000',
+      status: 'canceled',
+      referenceId: 'org-1',
+    })
+    queueTableRows(member, [{ role: 'member' }])
+
+    const result = await getWorkspaceCreationPolicy({ userId: 'user-1' })
+
+    expect(result.canCreate).toBe(false)
+    expect(result.blockedReasonCode).toBe('organization-subscription-inactive')
+    expect(result.status).toBe(403)
+  })
+
+  it('lets an owner of a lapsed organization fall back to their personal plan', async () => {
+    mockGetUserOrganization.mockResolvedValue({
+      organizationId: 'org-1',
+      role: 'owner',
+      memberId: 'member-1',
+    })
+    mockGetOrganizationSubscription.mockResolvedValue({
+      id: 'sub-1',
+      plan: 'team_6000',
+      status: 'canceled',
+      referenceId: 'org-1',
+    })
+    mockGetHighestPrioritySubscription.mockResolvedValue({
+      id: 'sub-2',
+      plan: 'pro_6000',
+      status: 'active',
+    })
+    queueTableRows(member, [{ role: 'owner' }])
+    queueTableRows(workspace, [{ value: 0 }])
+
+    const result = await getWorkspaceCreationPolicy({ userId: 'user-1' })
+
+    expect(result.canCreate).toBe(true)
+    expect(result.workspaceMode).toBe(WORKSPACE_MODE.PERSONAL)
+    expect(result.maxWorkspaces).toBe(3)
+    // The membership snapshot lets creation tell "already a member" apart from
+    // "joined mid-create", so the owner is not spuriously 409'd.
+    expect(result.observedOrganizationId).toBe('org-1')
+  })
+
   it('allows pro users to create up to three personal workspaces', async () => {
     mockGetHighestPrioritySubscription.mockResolvedValueOnce({
       id: 'sub-1',
@@ -390,7 +442,7 @@ describe('getWorkspaceInvitePolicy', () => {
 
     expect(result.allowed).toBe(true)
     expect(result.upgradeRequired).toBe(false)
-    expect(mockGetHighestPrioritySubscription).toHaveBeenCalledWith('owner-1')
+    expect(mockGetHighestPrioritySubscription.mock.calls[0]?.[0]).toBe('owner-1')
   })
 
   it('allows grandfathered workspaces when the billed user has a pro plan', async () => {
diff --git a/apps/sim/lib/workspaces/policy.ts b/apps/sim/lib/workspaces/policy.ts
index 2fc4bab89b8..70d3cdb06d2 100644
--- a/apps/sim/lib/workspaces/policy.ts
+++ b/apps/sim/lib/workspaces/policy.ts
@@ -10,6 +10,7 @@ import type { PlanCategory } from '@/lib/billing/plan-helpers'
 import { getPlanType, isEnterprise, isMax, isPro, isTeam } from '@/lib/billing/plan-helpers'
 import { hasUsableSubscriptionStatus } from '@/lib/billing/subscriptions/utils'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
+import type { DbOrTx } from '@/lib/db/types'
 import {
   CONTACT_OWNER_TO_UPGRADE_REASON,
   UPGRADE_TO_INVITE_REASON,
@@ -79,6 +80,16 @@ export interface WorkspaceCreationPolicy {
   currentWorkspaceCount: number
   reason: string | null
   status: number
+  /**
+   * The organization the caller belonged to when this decision was made
+   * (`null` for none). A PERSONAL decision is legitimate for an existing
+   * member whose organization has no usable Team/Enterprise plan, so
+   * creation compares membership against this snapshot instead of treating
+   * any membership as a mid-create join.
+   */
+  observedOrganizationId: string | null
+  /** Discriminant for blocked states the workspace mode cannot distinguish. */
+  blockedReasonCode?: 'organization-subscription-inactive'
 }
 
 interface GetWorkspaceCreationPolicyParams {
@@ -238,9 +249,12 @@ export async function getInvitePlanCategoryForOrganization(
  * user. Exposed so bulk callers can batch by unique user id. Returns
  * `'free'` when there is no usable paid subscription.
  */
-export async function getInvitePlanCategoryForUser(userId: string): Promise<PlanCategory> {
+export async function getInvitePlanCategoryForUser(
+  userId: string,
+  executor: DbOrTx = db
+): Promise<PlanCategory> {
   try {
-    const sub = await getHighestPrioritySubscription(userId)
+    const sub = await getHighestPrioritySubscription(userId, { executor })
     if (!sub || !hasUsableSubscriptionStatus(sub.status)) return 'free'
     return getPlanType(sub.plan)
   } catch (error) {
@@ -283,6 +297,7 @@ export async function getWorkspaceCreationPolicy({
       currentWorkspaceCount: 0,
       reason: 'Only organization owners and admins can create organization workspaces.',
       status: 403,
+      observedOrganizationId: membership?.organizationId ?? null,
     }
   }
 
@@ -312,6 +327,7 @@ export async function getWorkspaceCreationPolicy({
         currentWorkspaceCount: 0,
         reason: null,
         status: 200,
+        observedOrganizationId: membership?.organizationId ?? null,
       }
     }
 
@@ -326,6 +342,7 @@ export async function getWorkspaceCreationPolicy({
       currentWorkspaceCount,
       reason: null,
       status: 200,
+      observedOrganizationId: membership?.organizationId ?? null,
     }
   }
 
@@ -349,6 +366,7 @@ export async function getWorkspaceCreationPolicy({
           currentWorkspaceCount: 0,
           reason: 'Only organization owners and admins can create organization workspaces.',
           status: 403,
+          observedOrganizationId: membership?.organizationId ?? null,
         }
       }
 
@@ -361,6 +379,32 @@ export async function getWorkspaceCreationPolicy({
         currentWorkspaceCount: 0,
         reason: null,
         status: 200,
+        observedOrganizationId: membership?.organizationId ?? null,
+      }
+    }
+
+    /**
+     * Lapsed organization (no usable Team/Enterprise plan). A plain member
+     * gets NO personal fallback: letting them create workspaces here would
+     * hand them an estate outside every admin's view purely because billing
+     * lapsed — exactly the purview escape this regime closes. Owners and
+     * admins DO fall through to the personal regime below: they sit at the top
+     * of the hierarchy, so there is no purview to escape, and after a
+     * downgrade they are usually back on a personal plan they still pay for.
+     */
+    if (!isOrgAdminRole(orgRole)) {
+      return {
+        canCreate: false,
+        workspaceMode: WORKSPACE_MODE.ORGANIZATION,
+        organizationId,
+        billedAccountUserId: (await getOrganizationOwnerId(organizationId)) ?? userId,
+        maxWorkspaces: null,
+        currentWorkspaceCount: 0,
+        reason:
+          "Your organization's subscription is inactive. Ask an organization owner to reactivate it before creating workspaces.",
+        status: 403,
+        observedOrganizationId: membership?.organizationId ?? null,
+        blockedReasonCode: 'organization-subscription-inactive',
       }
     }
   }
@@ -380,6 +424,7 @@ export async function getWorkspaceCreationPolicy({
       currentWorkspaceCount,
       reason: `This plan supports up to ${maxWorkspaces} personal workspace${maxWorkspaces === 1 ? '' : 's'}.`,
       status: 403,
+      observedOrganizationId: membership?.organizationId ?? null,
     }
   }
 
@@ -392,6 +437,7 @@ export async function getWorkspaceCreationPolicy({
     currentWorkspaceCount,
     reason: null,
     status: 200,
+    observedOrganizationId: membership?.organizationId ?? null,
   }
 }
 
diff --git a/packages/utils/src/string.test.ts b/packages/utils/src/string.test.ts
index af81c22d5aa..e96bfb932dd 100644
--- a/packages/utils/src/string.test.ts
+++ b/packages/utils/src/string.test.ts
@@ -3,6 +3,7 @@
  */
 import { describe, expect, it } from 'vitest'
 import {
+  formatQuotedNameList,
   isVersionedType,
   normalizeEmail,
   sanitizeForJsonb,
@@ -121,3 +122,17 @@ describe('normalizeEmail', () => {
     expect(normalizeEmail('user@example.com')).toBe('user@example.com')
   })
 })
+
+describe('formatQuotedNameList', () => {
+  it('lists all names quoted when within the cap', () => {
+    expect(formatQuotedNameList(['A', 'B'], 3)).toBe('"A", "B"')
+  })
+
+  it('truncates to the cap with an overflow tail', () => {
+    expect(formatQuotedNameList(['A', 'B', 'C', 'D', 'E'], 3)).toBe('"A", "B", "C" and 2 more')
+  })
+
+  it('returns an empty string for no names', () => {
+    expect(formatQuotedNameList([], 3)).toBe('')
+  })
+})
diff --git a/packages/utils/src/string.ts b/packages/utils/src/string.ts
index f087494ff77..d2215ac3a0c 100644
--- a/packages/utils/src/string.ts
+++ b/packages/utils/src/string.ts
@@ -97,3 +97,21 @@ export function sanitizeValueForJsonb<T>(value: T): T {
   }
   return value
 }
+
+/**
+ * Formats a list of names as quoted values with an overflow tail, listing at
+ * most `maxListed` names.
+ *
+ * @example
+ * formatQuotedNameList(['A', 'B'], 3)            // '"A", "B"'
+ * formatQuotedNameList(['A', 'B', 'C', 'D'], 3)  // '"A", "B", "C" and 1 more'
+ * formatQuotedNameList([], 3)                    // ''
+ */
+export function formatQuotedNameList(names: string[], maxListed: number): string {
+  const listed = names
+    .slice(0, maxListed)
+    .map((name) => `"${name}"`)
+    .join(', ')
+  const overflow = names.length - maxListed
+  return overflow > 0 ? `${listed} and ${overflow} more` : listed
+}
diff --git a/scripts/check-api-validation-contracts.ts b/scripts/check-api-validation-contracts.ts
index 31fd989cf4f..4e7f5f6ca23 100644
--- a/scripts/check-api-validation-contracts.ts
+++ b/scripts/check-api-validation-contracts.ts
@@ -9,8 +9,8 @@ const QUERY_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/queries')
 const SELECTOR_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/selectors')
 
 const BASELINE = {
-  totalRoutes: 993,
-  zodRoutes: 993,
+  totalRoutes: 994,
+  zodRoutes: 994,
   nonZodRoutes: 0,
 } as const