Invitations & approvals
How vault-share invitations work — accepting, declining, expiry, revocation — and how organization admin approval fits into the flow.
Sharing a vault doesn't grant access instantly: it creates an invitation the recipient must accept. In organizations, an admin approval step can sit in front of that. Item shares are different — they activate immediately with no invitation to accept.
The invitation lifecycle#
| Status | Meaning |
|---|---|
| Pending | Waiting for the recipient to accept or decline. |
| Pending approval | Waiting for an organization admin to approve before the recipient can act. |
| Accepted | The recipient accepted; active shared access was created. |
| Declined | The recipient turned it down. |
| Expired | The optional expiry date passed before it was accepted. |
| Revoked | The sender withdrew the invitation. |
Accept or decline an invitation#
- Open Sharing → Manage → Pending. A badge shows how many invitations are waiting.
- Review who sent it, what is being shared, the access level, and any message.
- Choose Accept to gain access, or Decline to refuse.
On accepting a vault invitation, your device unwraps the vault key with your private key — the vault then appears under Shared with Me. Declining discards the invitation; the sender can invite you again later.
An invitation is addressed to your account email and can only be accepted by that account. If it carries an expiry date and you accept too late, it is marked expired and the sender must share again.
For senders#
From the vault's Sharing & members page (pending invitations list) or Sharing → Manage → Sent you can watch invitation status and revoke a pending invitation before it's accepted. You can't send a second invitation to someone who already has one pending — revoke the old one first.
Organization approval queue#
Team Business Enterprise
When an admin enables require sharing approval (organization-wide or per vault), vault shares take an extra step:
- The sender shares as usual, but the invitation is created as Pending approval instead of going to the recipient.
- An admin reviews it in the approval queue and approves or rejects it.
- Only after approval does the invitation become Pending for the recipient to accept.
Approvals and rejections are recorded in the audit log.
The approval workflow currently applies to vault sharing only. If a vault's policy requires approval, sharing an individual item from it is blocked — share the vault instead, or ask an admin to adjust the policy.