---
title: "Verify invitation acceptance rejects a mismatched signed-in account"
description: "Open an email-bound invitation while signed in as another controlled account and verify the application requires the intended identity before joining."
canonical_url: "https://vostride.com/agent-library/organization-membership/invite-wrong-account.md"
md_url: "https://vostride.com/agent-library/organization-membership/invite-wrong-account.md"
content_kind: "recipe"
topic: "organization-membership"
---

# Verify invitation acceptance rejects a mismatched signed-in account

Open an email-bound invitation while signed in as another controlled account and verify the application requires the intended identity before joining.

## Risk

Email-bound invitations should not silently attach the current browser user when that identity differs from the invited address. This recipe also checks that the intended recipient can recover from the mismatch without losing the invitation.

## Fixtures

- A disposable organization and an invitation explicitly bound to recipient Amber email.
- A different test-owned account Blue already signed in, plus both controlled inboxes.
- A documented invitation identity policy and a membership inspection hook for both account identifiers.

## Steps

1. Create an invitation for Amber and retrieve its exact run-specific link from the Amber inbox.
2. Open that link while signed in as Blue and verify the page identifies the mismatch or requires switching accounts before acceptance.
3. Attempt the visible acceptance action if offered and verify Blue does not gain organization membership.
4. Sign out and authenticate as Amber through the supported flow, then reopen the same invitation and accept.
5. Verify Amber sees the organization, Blue has no membership according to the hook, and the invitation is associated with Amber stable account identifier.

## Expected results

- The mismatched browser identity cannot consume the email-bound invitation for itself.
- A rejected mismatch does not make the valid invitation unusable for its intended recipient.
- Only the intended account receives the selected organization role.

## False-pass traps

- A masked email hint alone does not prove the currently signed-in account is prevented from joining.
- Some products intentionally use unbound join links; this recipe requires the email-bound invitation contract.

## Cleanup

- Remove Amber membership, revoke unused invitations, and sign out both test accounts.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Organization membership QA recipes](/agent-library/organization-membership.md)
- [Software factory QA library](/agent-library.md)