Portal setup to client access

Step by step

1. Prepare the portal Admin

   Admin configures the foundation: Brand themes (color palette, logo, typography defaults — one per customer brand or per delivery-team brand), email templates (per-event branded templates for invitation, document notification, approval request, decision callback, status update, comment notification, weekly digest, and inactive-user reminder), and the portal sites master (one row per Account tenant — portal code, Account, brand theme, subdomain slug, optional custom domain, O auth provider if SSO, magic link enabled, default email template, Owner Portal Manager). Brand changes that affect a live portal site flow through the MDM approval workflow with Admin sign-off; email templates preview-render against a fixture row before publish.

   • Configure the approved identity and brand
   • Updates Portal sites, Brand themes, Email templates
   ApprovalA person approves before the work moves on.

2. Expose the project Portal Manager

   Portal Manager picks which internal Projects (read from Project Management) to expose on each portal site via the portal projects line items: snapshots the project name, sets display order, marks Status: Active. A Project hidden mid-engagement flips to Status: Hidden rather than being deleted, so historical document shares, approval requests, and client activities keep their referential anchor for audit.

   • Publish the permitted project context
   • Updates Portal projects

3. Invite and grant access Portal Manager

   Portal Manager creates a client users row (full name, Email, portal site, Account, client role: Approver / Collaborator / Viewer) and grants per-project access via portal user access rows (one per portal project with access level: View / Comment / Approve). Inviting the client provisions the OAuth / SSO entry when portal site O auth provider is set, generates a magic links row with Purpose: Invite setup and expires at: now + 7 days, and the notification service delivers the branded invitation using the portal site’s themed email templates row. The client clicks the link, completes setup (password or SSO bind), and the magic-link auth handler flips client user status: Invited → Active and stamps activated at.

   • Bind an authenticated user to explicit project grants
   • Updates Client users, Portal user access, Magic links

Admin

Systems administrator. Owns portal sites, brand themes, email templates, OAuth / SSO configuration, and integration health. Not the day-to-day portal operator.

Portal Manager

Owns the client users list and access grants for one or more portal sites. The day-to-day operator of the external user lifecycle — invitations, role changes, suspensions, access reviews.

Client User — Viewer

External client user with read-only access. The default tier for client stakeholders who need visibility but no contribution rights.