document invite expiry and token revoke on leave

platform/connectors.mdx

@@ -58,6 +58,10 @@ Some integrations, such as a CI pipeline, authenticate with a workspace token in
 Never commit a token to a repository or paste it into a chat. Store it as a CI secret.
 </Warning>
 
+<Note>
+Removing a member or leaving the workspace revokes the workspace API tokens that person created there. Create a new token and update CI or agent secrets that still used theirs.
+</Note>
+
 ## Connect a code provider
 
 The top of **Integrations** lists your code providers:

platform/support/security.mdx

@@ -54,6 +54,7 @@ Assistants reach Graphify through the hosted MCP server at `https://api.graphify
 
 - Each assistant signs in with OAuth in the browser. No API key sits in a config file.
 - An agent that cannot open a browser, such as one in CI, uses an API token from the **MCP** tab of **Connectors**. Store it as a CI secret, never in the repository.
+- When a member leaves or is removed, Graphify revokes the workspace API tokens that member created in that workspace. Remint any CI or MCP token they owned before reconnecting pipelines or agents.
 - An assistant reaches only the workspace it signed in to, and only repositories indexed in that workspace.
 - Some tools save notes or switch workspaces. Approve a tool call only when that is what you meant.
 

platform/workspaces-and-members.mdx

@@ -48,6 +48,10 @@ Member management is available on **Teams** workspaces. Free and Pro personal wo
   </Step>
 </Steps>
 
+<Note>
+Teams invitations expire after **48 hours**. **Resend** issues a new accept link and starts a fresh 48-hour window. An expired invite returns an error on accept; send a new invite or resend from **Members**.
+</Note>
+
 ## Request access
 
 If a teammate already installed Graphify on your GitHub organization, connecting that org can offer **request access** instead of creating a second workspace. Owners review pending requests on **Members** and in **Settings**.