System admin creates account for people qualified to use the system

[randygit]

• [ ] enter user name
• [ ] enters email address (this should unique)
• [ ] assigns role
• [ ] creates temporary password (encrypted)
• upon saving
  • [ ] saves to user table (status pending)
  • [ ] email user with a link valid for 30 minutes only
  • [ ] saves activity to sys admin log

[randygit]

valid roles are:

• system admin, creates accounts, disables,review and publish docs
• contributor, review and publish docs
• editor, reviews and edits newly created docs or docs pulled out from production
• author, creates docs

[randygit]

we can leave out temporary token, just a link to the login page.

[jotom]

Just make the account active once logged in. Even if they don't want to change passwords. Adding a verification stage and putting status of user as pending would only add an extra step to check if password changed. Save extra use case/resources in case they have a mandatory change password rule every three months.