Arc now uses an invite-only access model enforced at the database level.
What Changed
Email Allowlist A new email_allowlist table controls who can sign up. The check is built into the user creation trigger — it cannot be bypassed at the application layer.
Admin Allowlist UI Super admins can manage the allowlist from /admin/allowlist. Add emails individually with optional notes, or remove access for any email. Existing users were automatically seeded into the allowlist on deployment.
Cleaner Error Messages Attempts to sign up with an unapproved email now receive a clear message: "This email is not authorised to access this platform."
Why
During the pilot phase, Arc is available to a controlled set of invited users only. The allowlist ensures no unauthorised access is possible even if the sign-up URL becomes known.