Invite, change role, deactivate. Tenant-admin only.
Every invite + role change + deactivation is audit-logged.