KemalIdentity::Authz::Membership

An account belongs to a tenant.

Separate from role assignment, and the separation is deliberate. Membership answers "may this person be inside this tenant at all", roles answer "and what may they do there". A person can be a member with no roles — freshly invited, or with everything revoked while an investigation runs — and that is a state the model has to be able to express, because the alternative is deleting them and losing the audit trail of when they joined.