A marketing agency runs six client accounts on Giant Context, the platform I build. For a product launch, they bring in a freelance copywriter for two weeks to write email campaigns for exactly one of those clients. The question that decides whether the agency can use my platform for real work is small and specific. Can they give that freelancer access to one email tool, on one client, and nothing else?

Yes.

Everyone who works in an organization is a member of that organization. That part is not optional, because membership is the anchor for identity, billing, and the audit trail. What varies is how much of the organization your membership reaches, not whether you belong.

So the freelance copywriter is added to the agency's organization, but as a collaborator, the role built for exactly this, an outsider who works with the company without being of it. A collaborator sees nothing in the organization by default. Access is then granted one resource at a time, and the copywriter is granted one, the email app for that single client. That grant is the whole of what they can touch. The other five clients, the other tools, the billing, the other projects, none of it is hidden behind a permission error they can see the shape of. Ungranted, it is simply not there for them.

This is business logic rather than engineering, though the two are the same decision seen from different sides.

A platform that only serves one person per account has a ceiling. The market above that ceiling, the agencies, the teams, the companies with contractors, is where the real money and the sticky, hard-to-leave accounts are. But those customers cannot adopt a tool that makes them overshare access, because oversharing access is a liability they will not take on for a piece of software. The moment a platform can express this freelancer, this app, two weeks, it becomes usable by a whole tier of customer it could not touch before.

So app-level membership decides whether the product tops out at solo operators or grows into the accounts that run agencies. The narrow grant is what unlocks the wide market.

The agency brings the freelancer in for two weeks, the work gets done, the access is gone when the engagement ends, and the agency trusts the platform a little more the next time it needs to bring someone in. That trust, compounded across every scoped grant a customer makes, is the actual product. Access control is not a defensive feature here. It is a growth one.