Revoke invites on move-out
- Type
- auto_revoke_on_moveout
- Category
- Lifecycle
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, or after a denial (notify only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- OrgIntegration
- EnforcementHow a configured row behaves. Enforce blocks. Require approval opens an admin inbox when the type supports it. Audit only records and never blocks.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — leftover invitations stay enabled after move-out.
On resident delete, OpenApp revokes enabled invitations authored by that user whose grants include doors of the apartment they left. The user account is not deleted. Each revocation is audited as policy.moveout.revoked.
When it is enforced
Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.
Where to set it
Settings → Policies (org) or the integration Policies tab.
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Shared row fieldsenforcement (enforce, require_approval,audit_only) and enabled apply to every type;audit_only and disabled rows never block.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| applies_to | string or string[] | No | agentapi_keyinvitationmemberresidentadminall | Principal kinds this row binds. Closed set: agent, api_key, invitation, member, resident, admin, all. Unknown strings and empty arrays are rejected. `all` matches every kind. When omitted, the type-specific default applies (see Default). Device-tier rows without `applies_to` often bind everyone, including admins. Default: Type-specific; org/integration rows often bind residents, not generic members. |
| output | string or integer | No | — | Optional channel or output id. When set, the policy binds only that output. When omitted, it binds every output of the tier target. A scoped row does not apply when the acting output is unknown. |
How overlapping rows combine
Boolean OR across applicable enforcing rows (any revoke-on-move-out wins). Disabled and audit_only rows never revoke.
Example
A resident who invited a cleaner to their apartment door has that invitation revoked when they are removed from the apartment.
{}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- Expire dormant users (auto_expire_dormant_users)
- Max active invitations per user (invitation_max_active_per_user)