Removing someone revokes their access to the whole organization. Like demoting, the one case that matters is the last admin: an organization can never be left with no one able to administer it.
Contract. DELETE /v1/security/tenants/{tenantId}/members/{userId}
(idempotent → 204). Removing an already-absent member still returns 204, so the
UI treats a 204 and a 404-then-refresh identically: the row is gone.
⚠ The last-admin refusal does not exist yet — this frame proposes it. Today
backend/security/src/routes/authz.ts would delete the last admin and leave the org
unadministrable. Approving this frame commissions a 409 LAST_ADMIN on this
operation AND the client-side pre-check that disables the button. The disabled button is an
affordance, not the guard — the server must refuse independently.
403 is not this. A member without permission to remove others gets a
403 FORBIDDEN (frame (e)) — that is an authorization denial, shown in place, never
a sign-in redirect. The last-admin 409 is different: the caller is allowed, but the
action is refused to protect the org.