Stable vocabulary
- User: one human identity.
- Account: a personal or organization ownership, quota, usage, and lifecycle boundary.
- Team: an access group inside an organization account, never a billing owner.
- Entitlements: resolved capabilities and limits. Usage is tracked separately.
The account owning a resource determines its tier. A Pro user does not lend Pro limits to a Free organization.
Resolution
Forge resolves the immutable tier version, active time-bounded overrides, project requests that may only lower limits, platform safety ceilings, and suspension state. The canonical result is hashed and frozen into deployment evidence.
GET /api/accounts
GET /api/accounts/:accountId
GET /api/accounts/:accountId/capabilitiesUsage
Strong gauges track retained resources. Period counters track builds, time, requests, and bandwidth. Idempotent expiring reservations serialize concurrent builds and uploads. A downgrade blocks new usage increases but preserves reads, export, deletion, and usage reduction.
Operator changes are ledger entries
Platform administrators inspect account, usage, assignment, and override evidence at the account ledger. Before writing, Forge resolves and displays the exact effective entitlement diff. A confirmed action appends a reasoned, actor-attributed assignment or time-bounded override with an account-bound idempotency key; it never rewrites history.
The operations dashboard compares 7-, 30-, and 90-day growth, labels storage and request-pressure evidence separately, and links threshold crossings to bounded enforcement. IP churn is derived from account-and-hour-separated HMAC fingerprints: raw IPs are not stored, each hour is capped at 16 fingerprints, and rows expire after 90 days. Warnings, resolutions, temporary personal-account request caps, and clears are append-only. A cap can only lower an existing fixed-window allowance and expires within 30 days; crossing a signal never causes automatic punishment.
User lifecycle
User credentials are active, suspended, or tombstoned. Suspension advances an authorization generation and blocks password, JWT, personal access token, Git, and Forge Identity access. Tombstoning redacts public identity fields while preserving foreign-key-safe audit evidence; repository objects are removed through the R2-aware deletion coordinator first.
Hosted applications
Forge Identity is app-scoped and explicitly consented. Hosted apps never receive Forge control-plane cookies, platform credentials, D1 bindings, or unrestricted account/team directories.
Detailed contract
Read the full Accounts, Teams, Service Tiers, Entitlements, and Usage contract, the Account operations contract, and the Forge Deploy specification.