Invitations
The only way an account gains its first credential, including the first administrator's.
An account with no credential cannot be signed into, and there is no open registration. An invitation is how that changes.
cardinal invite alonfils -for 48h # prints a single-use link
cardinal invite list # what is outstanding
cardinal invite revoke alonfils
The link is single use and expires. What it grants is deliberately narrow, and the CLI says so where somebody about to paste it into chat will read it:
Single use. It grants no session and cannot administer anything —
the holder can register one passkey on this account and nothing else.
That is what makes it safe to send over an ordinary channel. An invitation is not a way in; it is permission to register one credential on one account. The one exception, from Cardinal 0.7.0: when that credential is a synced passkey, the same link also takes one device-bound passkey, and only that (passkeys).
From Cardinal 0.7.0, when the account has an email and notification email is on, the link is also mailed to that address, and the console says where it went. The administrator sets the address when adding the person; enrolment no longer asks for one.
Issuing one is administration
Invitations are issued by whoever holds the people tier: user-admins or
directory-admins. Redeeming one is unauthenticated by necessity, because the
account has no credential yet, so each of those routes carries its own rate
limit and the token is the only thing that authorises them.
The first one
cardinal-server init performs first-run setup: it publishes a policy set, creates the
first administrator and prints their invitation. It reaches the database
directly, because it runs before there is anybody to authenticate as.
In the console
A person's page in Directory → People shows their outstanding invitation and lets an administrator issue or revoke one.