@@ -8,8 +8,8 @@ import { useQueryStates } from 'nuqs'
 import { isApiClientError } from '@/lib/api/client/errors'
 import type { PersonSummary } from '@/lib/api/contracts/people'
 import { organizationRoutes } from '@/lib/navigation/paths'
+import { peopleParsers, serializePeopleView } from '@/lib/people/search-params'
 import { PersonModal } from '@/app/o/[organizationId]/people/[memberId]/person-modal'
-import { peopleParsers, serializePeopleView } from '@/app/o/[organizationId]/people/search-params'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import {
   CredentialDetailHeading,
 
@@ -21,14 +21,10 @@ import { ChevronLeft, ChevronRight, Search } from '@sim/emcn/icons'
 import { useQueryStates } from 'nuqs'
 import { EmptyState } from '@/components/empty-state/empty-state'
 import { isApiClientError } from '@/lib/api/client/errors'
+import { peopleParsers, peopleUrlKeys, serializePeopleView } from '@/lib/people/search-params'
 import { ChartCanvas } from '@/app/o/[organizationId]/people/chart-canvas'
 import { ChartEmptyState } from '@/app/o/[organizationId]/people/chart-empty-state'
 import { LoadingStatus } from '@/app/o/[organizationId]/people/loading-status'
-import {
-  peopleParsers,
-  peopleUrlKeys,
-  serializePeopleView,
-} from '@/app/o/[organizationId]/people/search-params'
 import { usePeoplePicker } from '@/app/o/[organizationId]/people/use-people-picker'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import { ResourceLoadError } from '@/app/workspace/[workspaceId]/components/resource/components/resource-empty-state'
 
@@ -8,15 +8,11 @@ import { useQueryStates } from 'nuqs'
 import { EmptyState } from '@/components/empty-state/empty-state'
 import type { PersonSummary } from '@/lib/api/contracts/people'
 import { organizationRoutes } from '@/lib/navigation/paths'
+import { peopleParsers, peopleUrlKeys, serializePeopleView } from '@/lib/people/search-params'
 import { PEOPLE_SEARCH_MAX_LENGTH } from '@/lib/people/validation'
 import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
 import { PEOPLE_COLUMNS, PEOPLE_SEARCH_PLACEHOLDER } from '@/app/o/[organizationId]/people/columns'
 import { LoadingStatus } from '@/app/o/[organizationId]/people/loading-status'
-import {
-  peopleParsers,
-  peopleUrlKeys,
-  serializePeopleView,
-} from '@/app/o/[organizationId]/people/search-params'
 import {
   ResourceLoadError,
   ResourceNoResults,
 
@@ -20,6 +20,7 @@ import { isOrganizationSettingsSectionAvailable } from '@/components/settings/na
 import { isApiClientError } from '@/lib/api/client/errors'
 import type { PeopleImportBody, PeopleImportResult } from '@/lib/api/contracts/people'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
+import { type PeopleSheet, readPeopleSheet } from '@/lib/people/read-sheet'
 import { saveBlob } from '@/lib/uploads/client/download'
 import {
   IMPORT_SOURCES,
@@ -28,10 +29,6 @@ import {
   ProviderFields,
   ProvisioningSource,
 } from '@/app/o/[organizationId]/people/import-source'
-import {
-  type PeopleSheet,
-  readPeopleSheet,
-} from '@/app/o/[organizationId]/people/read-people-sheet'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import { useScimConnection } from '@/ee/scim/hooks/scim'
 import { useImportPeople } from '@/hooks/queries/people'
 
@@ -5,10 +5,10 @@ import { ChipSwitch } from '@sim/emcn'
 import { List, RefreshCw, Users, Workflow } from '@sim/emcn/icons'
 import dynamic from 'next/dynamic'
 import { useQueryStates } from 'nuqs'
+import { peopleParsers, peopleUrlKeys } from '@/lib/people/search-params'
 import { IMPORT_PEOPLE_ACTION } from '@/app/o/[organizationId]/people/columns'
 import { PeopleDirectory } from '@/app/o/[organizationId]/people/people-directory'
 import { PeopleImportModal } from '@/app/o/[organizationId]/people/people-import-modal'
-import { peopleParsers, peopleUrlKeys } from '@/app/o/[organizationId]/people/search-params'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
 import { Resource } from '@/app/workspace/[workspaceId]/components/resource/resource'
 
 
@@ -13,10 +13,10 @@ import {
   toast,
 } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
-import type { BatchInvitationResult } from '@/lib/api/contracts/invitations'
 import { useSession } from '@/lib/auth/client'
 import { isEnterprise } from '@/lib/billing/plan-helpers'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
+import { buildInviteFailureMessage } from '@/lib/invitations/failure-message'
 import { quickValidateEmail } from '@/lib/messaging/email/validation'
 import type { PermissionType } from '@/lib/workspaces/permissions/utils'
 import { useOptionalWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
@@ -47,40 +47,6 @@ const MEMBERSHIP_HINTS: Partial<Record<Membership, string>> = {
 
 const EMPTY_WORKSPACE_IDS: string[] = []
 
-/** Distinct failure reasons listed in full before the remainder is counted instead. */
-const MAX_LISTED_FAILURE_REASONS = 3
-
-/**
- * Builds the submit error for a batch where some or all invitations failed.
- *
- * The server rejects per email and every reason names its own address, so the
- * reasons are listed rather than collapsed to the first one: inviting several
- * people who are all ineligible for the chosen membership is the common
- * multi-failure case, and reporting one of them hides who else needs attention.
- * Identical reasons are deduplicated, and beyond
- * {@link MAX_LISTED_FAILURE_REASONS} the tail is counted rather than listed so a
- * large batch cannot bury the modal in near-identical sentences.
- */
-export function buildInviteFailureMessage(
-  failures: BatchInvitationResult['failed'],
-  attemptedCount: number
-): string {
-  if (failures.length === 1) return failures[0].error
-
-  const headline =
-    failures.length >= attemptedCount
-      ? `None of the ${failures.length} invitations could be sent.`
-      : `${failures.length} of ${attemptedCount} invitations could not be sent.`
-
-  const reasons = [...new Set(failures.map((failure) => failure.error))]
-  const listed = reasons.slice(0, MAX_LISTED_FAILURE_REASONS)
-  const remaining = reasons.length - listed.length
-
-  return [headline, ...listed, remaining > 0 ? `And ${remaining} more.` : null]
-    .filter(Boolean)
-    .join(' ')
-}
-
 interface InviteModalProps {
   open: boolean
   onOpenChange: (open: boolean) => void
 
@@ -1,3 +1,7 @@
+export {
+  type WorkspaceRoleSource,
+  workspaceRoleLockReason,
+} from '@/lib/workspaces/permissions/role-lock'
 export { AddPeopleModal, type AddPeopleTarget } from './add-people-modal'
 export {
   MEMBER_ROLE_OPTIONS,
@@ -18,7 +22,5 @@ export {
   credentialRoleLockReason,
   RoleLockTooltip,
   skillEditorLockReason,
-  type WorkspaceRoleSource,
   workspaceMemberRemovalLockReason,
-  workspaceRoleLockReason,
 } from './role-lock'
@@ -3,27 +3,8 @@
 import type { ReactNode } from 'react'
 import { Tooltip } from '@sim/emcn'
 
-export type WorkspaceRoleSource = 'owner' | 'explicit' | 'org-admin'
 export type CredentialRoleSource = 'explicit' | 'workspace-admin'
 
-/**
- * Explanation shown when a workspace member's role is fixed and cannot be
- * edited. Returns null for editable roles.
- *
- * Mirrors the server guards on `PATCH /api/workspaces/[id]/permissions`, which
- * refuse the same three cases — so every reason here must have a guard there and
- * vice versa, or the UI offers a control that can only fail.
- */
-export function workspaceRoleLockReason(
-  roleSource: WorkspaceRoleSource | undefined,
-  options?: { isBilledAccount?: boolean }
-): string | null {
-  if (roleSource === 'org-admin') return 'Organization admins are automatically workspace admins'
-  if (roleSource === 'owner') return 'Workspace owner'
-  if (options?.isBilledAccount) return 'Workspace billing account'
-  return null
-}
-
 /**
  * Explanation shown when a workspace member cannot be removed from the
  * workspace. Returns null when removal is allowed.
 
@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
   describePolicyChange,
   describePolicyValue,
-} from '@/ee/access-requests/components/policy-changes'
+} from '@/ee/access-requests/lib/policy-description'
 
 const target = { kind: 'integration', id: 'slack_v2' } as const
 
 
@@ -7,9 +7,10 @@ import type {
   AccessRequestPreviewResponse,
   AccessRequestTarget,
 } from '@/lib/api/contracts/access-requests'
-import { BLOCK_NAMES } from '@/lib/block-metadata/names.generated'
-import { PERMISSION_GROUP_FIELDS } from '@/lib/permission-groups/fields'
-import { resolveAccessControlBlockType } from '@/lib/permission-groups/integration-allowlist'
+import {
+  describePolicyChange,
+  describePolicyValue,
+} from '@/ee/access-requests/lib/policy-description'
 
 interface PolicyChangesProps {
   changes: AccessRequestPolicyChange[]
@@ -18,74 +19,6 @@ interface PolicyChangesProps {
   targetLabel: string
 }
 
-function describePolicyItems(
-  values: string[],
-  configKey: AccessRequestPolicyChange['configKey'],
-  target: AccessRequestTarget,
-  targetLabel: string
-): ReadonlyMap<string, string> {
-  const items = new Map<string, string>()
-  const integrationTarget =
-    target.kind === 'integration'
-      ? resolveAccessControlBlockType(target.id.toLowerCase()).toLowerCase()
-      : null
-  for (const value of values) {
-    if (configKey === 'allowedIntegrations') {
-      const canonical = resolveAccessControlBlockType(value.toLowerCase()).toLowerCase()
-      const label = Object.hasOwn(BLOCK_NAMES, canonical)
-        ? BLOCK_NAMES[canonical]!
-        : canonical === integrationTarget
-          ? targetLabel
-          : value
-      items.set(canonical, label)
-    } else {
-      items.set(value, target.kind !== 'feature' && value === target.id ? targetLabel : value)
-    }
-  }
-  return items
-}
-
-export function describePolicyValue(
-  value: AccessRequestPolicyChange['before'],
-  configKey: AccessRequestPolicyChange['configKey'],
-  target: AccessRequestTarget,
-  targetLabel: string
-): string {
-  if (value === null) return 'All allowed'
-  if (typeof value === 'boolean') return value ? 'Restricted' : 'Allowed'
-  return value.length
-    ? [...describePolicyItems(value, configKey, target, targetLabel).values()].join(', ')
-    : 'None'
-}
-
-export function describePolicyChange(
-  change: AccessRequestPolicyChange,
-  target: AccessRequestTarget,
-  targetLabel: string
-): string {
-  const { before, after } = change
-  const describe = (value: AccessRequestPolicyChange['before']) =>
-    describePolicyValue(value, change.configKey, target, targetLabel)
-  if (typeof after === 'boolean') return `${describe(before)} → ${describe(after)}`
-  if (after === null) return 'Allow all'
-  const next = describePolicyItems(after, change.configKey, target, targetLabel)
-  if (before === null)
-    return next.size ? `Allow only ${[...next.values()].join(', ')}` : 'Allow none'
-  if (!Array.isArray(before)) return `${describe(before)} → ${describe(after)}`
-  const previous = describePolicyItems(before, change.configKey, target, targetLabel)
-  const added = [...next].filter(([id]) => !previous.has(id)).map(([, label]) => label)
-  const removed = [...previous].filter(([id]) => !next.has(id)).map(([, label]) => label)
-  const denylist = PERMISSION_GROUP_FIELDS[change.configKey].kind === 'denylist'
-  return (
-    [
-      added.length ? `${denylist ? 'Block' : 'Allow'} ${added.join(', ')}` : '',
-      removed.length ? `${denylist ? 'Unblock' : 'Remove'} ${removed.join(', ')}` : '',
-    ]
-      .filter(Boolean)
-      .join('; ') || 'No membership change'
-  )
-}
-
 export function PolicyChanges({ changes, impact, target, targetLabel }: PolicyChangesProps) {
   const [expanded, setExpanded] = useState(false)
   const detailsId = useId()