Design a backend workflow where an admin invites a user, the user accepts the invitation, and the account becomes active.

In production I would add abuse controls around invite creation and token attempts, avoid exposing whether arbitrary emails exist, and keep tokens hashed at rest. The onboarding state can drive first-login prompts, profile completion, and required terms acceptance. I would monitor invite delivery failures, acceptance rate, expired invites, resend frequency, and suspicious token failures. For regulated products, the audit trail would explain who invited whom, into which scope, and which permissions were granted.