#Lldap
ADR 0018: One group per service, with administration rights and quotas derived from the directory
Access to each service is granted by adding someone to a group; applications' administration rights follow the administrators group; quotas are set from the accounts page.
ADR 0017: Inviting people without sending a password, from an accounts page
Accounts are created without a password and the person chooses their own through a one-time link; an administration page, behind the VPN and SSO, replaces the command line.