Constellation role / domain override.

The two levels of member access. A constellation role is the default a person inherits in every domain currently inside that constellation. A domain override is an explicit role stored on one domain and wins over inheritance, including a deliberate downgrade. Removing the override restores the constellation role. Removing the domain from the constellation—or the person from the constellation—ends inherited access immediately but never deletes explicit domain assignments. People owns identity only; never assign roles in People or Invitations.