Epic: User invite improvements

[matthewelwell]

User Story: As an organisation administrator, I can delegate responsibility for inviting users to other non-admin users

What this means functionally is that we want to be able to allow users who are not organisation admins to invite users. These user should be restricted to inviting 'user' roles only, and not organisation admin users.

The current pieces of functionality that we have which are related are the following:

1. Group admins - this allows the user to manage membership of the group for which they are an admin of, but not invite users into the organisation
2. Organisation level permission MANAGE_USER_GROUPS - this allows the user to manage membership of all of the groups in a given organisation, but not invite users into the organisation

If we also had a way for these users to invite new users into the organisation, we could pair that with these functionalities to allow them to invite users into these groups.

Currently in the API, we have functionality already to 'attach' multiple groups to an invite, so I can see this working in that a user can create an invite and attach any groups to it that they have 'admin' access to it.

[SafkhanCader]

Thanks for raising this, @matthewelwell — this makes a lot of sense.

I like the idea of extending invite permissions to selected non-admin users, restricted to inviting standard user roles only (and not org admins). Pairing this with existing functionality like Group Admins and the MANAGE_USER_GROUPS permission feels like a natural fit.

A couple of clarifications/questions to align my understanding:

• Should this new invite capability be its own organisation-level permission (e.g., INVITE_USERS), or should it extend the scope of existing ones like MANAGE_USER_GROUPS?
• When attaching groups to an invite, do we enforce that the inviter can only attach groups where they hold admin rights, or should there be flexibility at the org level to override this?
• For auditing/security: should invites created by non-admins be clearly flagged in logs as “delegated invites” so admins can monitor usage?

I’m happy to explore an implementation approach if this direction is confirmed. My first thought would be:

1. Introduce a new INVITE_USERS permission (restricted to standard roles).
2. Extend invite creation logic to validate the inviter’s group admin access before attaching groups.
3. Ensure visibility in logs/notifications so org admins stay aware of delegated invitations.

This would strike a balance between flexibility for organisations and maintaining control/security at the admin level.