project gus workspace admin identity model 20260715T131447

For the Gus Workspace (gusthebass.com, LLC formation in progress), Justin wants [email protected] to serve as a single shared login for affiliate/business signups (SOSDirect, banks, etc.) where 2FA lands in his inbox today but the identity can be handed off to Michael later, without paying for an extra Workspace seat.

A Google Group cannot log into third-party sites or receive 2FA (mail just copies to all members, which would leak codes to Michael prematurely). The correct construct is a Google Workspace alias: [email protected] aliased onto [email protected]. This gives one free login, 2FA to Justin only, and a clean future handoff (reassign the alias, or hand over the whole seat) when Michael takes over.

An initial session created [email protected] as a Group by mistake; the fix in progress is to delete that Group and add the alias instead. Team-inbox addresses (e.g. hi@, support@) should stay Groups; only single-login/2FA addresses should be aliases.

Why: Justin's mental model of Google Groups vs aliases vs seats was fuzzy going in ('I don't really understand how google groups work'), and this distinction will recur for other shared/business identities (gusoutdoor.co, future entities).

How to apply: When setting up any shared business email identity for Justin, default to an alias (not a Group) if the use case is 'one person logs in today, hands off later' or involves 2FA/passwords. Only use a Group for pure team-inbox mail. scripts/forge_google_workspace_admin.py (registered this session, see memory/general/reference_google_workspace_admin_tool.md) supports both.

[auto-memory session dc0439e9-232a-4ece-9f5c-ba8976b9a69b, confidence 0.75, mode staged]