Company Identity & Linked Accounts

AIQLick separates three concepts that used to be mixed together:

• a User is a human login identity;
• a company identity proves control of the company's public mailbox and records its representative;
• a linked-account group lets one person securely switch among several User identities and their profiles.

Linking never merges or moves domain data. CVs, candidates, roles, subscriptions, credits, billing records, and company memberships remain attached to their original records.

Public company email and activation

Every company has one public company email. It is required during onboarding or Add company, and it must be verified before the company becomes active. The company must also have one directly assigned human User as its owner and representative. That User must be active, verified, and have a current linked-account membership (a standalone one-User group is valid).

important

A User's verified login email does not verify a company mailbox. A company may use the same address as its representative's login, but the company-email challenge must still be completed.

Two-part activation invariant

A verified mailbox without a direct linked User owner is not operational. Likewise, assigning an owner does not bypass mailbox verification. Both conditions must hold before the lifecycle can become ACTIVE.

The address is normalized for uniqueness. No two companies may reserve the same address, including when either company is still Pending. The address is not published while its claim is Pending.

Lifecycle	Visible in Linked Accounts	Selectable	Public email and discovery	Normal workspace access
PENDING	Yes	Activation only	Hidden until verification	No
ACTIVE	Yes	Yes	Verified email is public	Yes
SUSPENDED	Yes, disabled	No	Hidden	No
UNCLAIMED	No	No	Hidden	No
REVIEW_REQUIRED	Yes, blocked	No	Hidden	No

Company directory, jobs, connections, invitations, billing, AI operations, team management, and other company-scoped data require an Active company.

Direct linked owner invariant

The direct owner is the human User referenced by the company's CompanyIdentity.representativeUserId. A billing owner, generic company membership, Company Admin role, Support Agent role, Super Admin role, or Root role does not substitute for this relationship. The representative must be active, verified, and have one current LinkedAccountMembership; a standalone one-User linked group satisfies the membership requirement.

If that relationship is missing, or the representative becomes inactive, unverified, or unlinked, the company stays or returns to non-operational Pending. Operational guards check the lifecycle, verified current claim, representative eligibility, and linked membership together. An Unclaimed shell cannot operate or appear as a selectable profile.

Suspended and Unclaimed companies never expose a public company email. A suspended company can be reactivated directly only when its existing verified claim and direct linked representative are still valid. Otherwise recovery goes through Pending and the staged verification flow.

No ownership shortcut

The legacy admin ownership mutation cannot directly replace a representative, billing owner, role, or public email. It is rejected and audited. Administrators can help resolve the account or suspend it, but every owner change must use the same linked-account staged transfer and company-mailbox verification described below.

Verify or resend

The verification email contains both a link and a manual code. A challenge lasts one hour and permits five code attempts. Resending is available after 60 seconds, is limited to five sends per hour, and invalidates every older challenge for the claim.

Verification is safe to repeat. Following an already-consumed link returns the current activation state instead of applying the transition twice.

Change an active company's email

Changing the public email creates a Pending replacement claim. The existing verified address remains public and the company remains Active while the replacement is being verified. Only successful verification swaps the public address and releases the old claim.

Linked Accounts

Open Settings → Linked Accounts to see every linked human User and the personal and company profiles beneath it. The screen shows the login methods, last use, privilege badge, company role, lifecycle, and public-email verification state.

The following human User types may participate:

• Standard User
• Company Admin
• Support Agent from the core platform support-role service
• Super Admin
• Root

AI Agent records are company resources, not login identities. Accounts in the separate support application and support backend cannot be linked here.

Link another User

1. Reauthenticate the current account and complete its enabled two-factor challenge.
2. Enter the target User's login email.
3. Prove the target account with its password or Google identity and complete its enabled two-factor challenge.
4. Review every User, company profile, and privilege that will become switchable.
5. Confirm the link.

Privileged Users must enable two-factor authentication before first joining a group. Linking a Root or Super Admin requires typing LINK ROOT ACCESS in the confirmation step. A target that already belongs to another multi-account group must leave that group first; groups are never merged automatically.

Challenges expire after 15 minutes and allow five proof attempts. Only the challenge ID is stored in the browser.

Google proof is purpose-bound

Password proof and Google proof reach the same link-challenge states, but Google linking is not a login redirect. The backend creates and stores hashed state and nonce values, encrypts the PKCE verifier, and binds the request to all of the following:

• the existing authenticated session and linked group;
• the link challenge and whether the current or target User is being proved;
• the expected active, verified User;
• that User's immutable Google provider subject.

The Google callback verifies the ID-token audience, verified email, nonce, and exact provider subject. It then redirects the browser to /auth/link-callback with only a short-lived, single-use exchange code. That code is exchanged against the existing authenticated session and cannot sign the browser in, replace the active session, or prove a different challenge. Enabled two-factor authentication is still completed after provider proof. The browser retains only the opaque link challenge ID and removes the callback code from history before exchange.

Switch profiles

After linking, every profile uses the same switch action. Switching to a privileged User grants that target User's complete current permissions without another proof prompt. Promotions take effect immediately, so all linked members are notified when a linked User gains a privileged role.

Destination profile	Route
Root or Super Admin	/admin
Support Agent	/support-portal
Active company	/company/dashboard
Personal profile	/jobseeker/dashboard
Pending company	/company-activation/[companyId]

Suspended and Unclaimed companies cannot be selected.

Assign a linked User to another owned company

An owner can use Manage → Assign linked owner on an owned company to dedicate a different linked User to that company. The selected User becomes the company's representative and owner, and the User's login email is proposed as the company's public email.

The target must be an active, verified human User in the same linked group. The operation requires a recent sensitive-action grant. Login-email verification is not reused: the proposed address must pass the company-email challenge. Until it does, the current owner, representative, billing ownership, and verified public email remain effective. The staged transition cannot leave the company without a direct linked User owner.

On successful verification, the server atomically updates the representative, ownership role, billing owner where applicable, current email claim, and public Company.email. It then revokes stale group-derived sessions and notifies every linked account. The transfer never moves CVs, candidates, talents, company resources, subscriptions, or credits.

An administrator cannot force this atomic swap through the legacy direct-transfer operation. Admin-assisted recovery must still identify an eligible linked human User, start a Pending claim for that User's login email, and complete the independent mailbox challenge before ownership or the public address changes.

Leave a linked group

Self-service unlinking applies only to the active User and requires that User's own reauthentication. The User receives a new standalone linked group and a fresh session. Other linked sessions derived from the old group are revoked; domain data is unchanged.

Session security

Profile switches rotate a revocable server session. Access tokens last 15 minutes; refresh tokens rotate in a Secure, HttpOnly cookie. A session expires after five idle hours or seven absolute days.

Security-sensitive actions require a recent 10-minute grant for the active User. These include linking, unlinking, login-security changes, billing or payment changes, company-email changes, and ownership changes.

Audit records preserve both identities:

• active User whose permissions authorized the action;
• originating credential User;
• session and linked-group IDs;
• selected company;
• IP and device metadata;
• action, target, and result.

Recovery

Problem	Recovery
Verification email did not arrive	Wait for the resend timer, confirm the masked address, then resend. Older links stop working.
Manual code is rejected	Request a new challenge before five failed attempts or after expiry.
Email is already reserved	Use a different public mailbox or ask an administrator to resolve the existing Pending/Review Required claim.
Pending company cannot open company tools	Complete email verification from the activation page; Pending access is intentionally limited.
Linked account is disabled or suspended	Switch to another selectable profile and contact an administrator. Disabling a User revokes its sessions.
Wrong linked User was selected for ownership	Do not verify the pending transfer. Cancel it and begin a new transfer; the current owner and email have not changed.
Unexpected privileged access appears	Unlink the active User or ask an administrator to revoke group sessions, then review the origin-aware security audit.