Notify on group membership change
- Type
- notify_on_group_membership_change
- Category
- Operational
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).
- Lifecycle
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- Org
- EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — no policy.group_membership_change event is written.
When a group’s membership changes — a member added or removed, or a household member joining or leaving — OpenApp writes policy.group_membership_change to the affected organization’s audit log, if an org-tree row in that organization has audit in channels. This type records only: it never blocks the change, and it sends no email, SMS, push, or webhook of its own (subscribe an audit webhook to forward the event). Membership events such as group.member_removed are written to every linked organization regardless of this policy.
When it is enforced
Evaluated when membership changes or on a background sweep, not on a request the affected person makes. It acts on existing access (for example revoking invitations) or records an audit event; it never blocks an open or an authoring request.
Where to set it
Settings → Policies (org).
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| channels | string[] | Yes | audit | Destination channels. Only `audit` is accepted until another channel exists. Unknown names and empty arrays are rejected. |
How overlapping rows combine
Channel union across applicable org-tree rows.
Example
When a member is removed from a linked group, Activity in the linked organization shows policy.group_membership_change. An audit webhook subscribed to that event forwards it.
{ "channels": [ "audit" ]}Integrations
This type is documented on these connectors:
- Home Assistant (home_assistant)
- KNX (knx)
- MQTT (mqtt)
- PalGate Cloud (palgate_cloud)
- Shelly Cloud (shelly_cloud)
- Shelly Websocket (shelly_websocket)
- Tasmota (tasmota)
- Virtual Access (virtual_access)
- Virtual Demo Devices (virtual_demo)
- Waveshare (waveshare)
Related
- Policy catalog
- Policies architecture guide
- Notify on new sharing (notify_on_new_sharing)
- External group sharing (external_group_sharing)