Ownership & accounts

Last verified: 2026-07-28 (read directly from Meta Business Settings).

Every other page here describes a pipeline. This one describes who holds the keys — which turns out to be the binding constraint on Instagram, and a real bus-factor risk on everything else.

One-line summary: all five brands' social identity currently hangs off one personal Facebook account and an auto-created, unnamed, unverified business portfolio. That portfolio cannot pass Business Verification, and Business Verification is what Instagram publishing needs.

How Meta ownership actually works

Three layers, and conflating them is why this got messy:

The important consequence: there is no such thing as an org-owned Meta account. You cannot sign a business portfolio over to databayt.org. A portfolio is always administered by human profiles. "Databayt owns this" translates concretely to three things:

1. The portfolio is named Databayt and carries the legal business name and address.
2. It has passed Business Verification against real company documents.
3. More than one human has Full access, so no single person's account is a single point of failure.

None of the three is true today.

Where we actually are

The portfolio

That "created by the linking flow" line is not a guess. The Instagram OIDC link carries create_business_manager: true in its state, so connecting an Instagram account to a Page silently created a business portfolio and named it after the Instagram account. Every brand Page we have since added lives inside an artefact of that side effect.

The people

Three entries, and only one is human:

No teammate has ever been invited. Not Ali (Aseel), not Moutaz, not Sedon. If the founder's account is locked, recovered, or lost, every brand Page and both Instagram accounts go with it.

The assets

The split is itself a problem: the Databayt Page cannot be linked to any Instagram account until its portfolio is under full control, and Meta gives no per-Page override.

Why this blocks Instagram, not just tidiness

Instagram's instagram_content_publish permission at Advanced Access needs App Review, which needs Business Verification — and Business Verification is verification of a legal business: registration documents, a matching legal name, an address, a verifiable phone or domain.

A portfolio with no legal name, no address, and a name inherited from an Instagram handle has nothing to verify. So the ownership question is not housekeeping deferred until later; it sits directly on the critical path to Instagram publishing, and it is worth doing before more brands are onboarded into the wrong container.

Facebook posting works today without it, because the app posts to Pages its own admin controls.

But test Standard Access before treating verification as the publishing gate. The same "own-admin grace" argument was proven for the Facebook read scopes on 2026-07-27: read_insights and pages_read_user_content turned out to be Standard Access — no App Review, no Business Verification, just the Use-Case grant and a token re-mint. Meta's access-levels doctrine (Standard covers users with a role on the app) applies to instagram_content_publish on paper too. Mkan is fully linked (gates 1–4 done) — a ~10-minute console test settles whether gate 5 is real: the hypothesis. Everything else on this page — naming, verification, a second admin, per-brand emails — is worth doing whatever that test says; ownership is about durability, not only about the permission.

Target state

1. One portfolio per company, not per accident. Create (or rename) a portfolio to Databayt, set the legal business name, address, phone, and website to the registered entity's real details.
2. Move every Page and Instagram account into it. Business Settings → Accounts → Pages → Add → Add an existing Page — the same wizard that worked for Hogwarts. Resolve the existing "Databayt" portfolio first: either take full control of it or move the Page out of it.
3. Submit Business Verification early. It is waiting, not working, and everything behind it is blocked while it queues.
4. At least two humans with Full access. One is a bus factor, not an owner.
5. Require two-factor for the portfolio, and set a primary Page.
6. Only then onboard Moallimee and Sijillee, so they are created inside the right container instead of being migrated later.

Inviting the team

Business Settings → Users → People → Invite people. Invitations go by email address and the invitee needs a Facebook profile to accept — there is no "invite a domain" and no seat that exists without a human behind it.

Suggested roles, adjustable per person:

Two things to know before sending invitations:

• Full access is total. It includes billing, deleting the portfolio, and removing other people. Give it deliberately, to two people, not to the whole team.
• Assign assets, not just seats. A person with portfolio access and no asset assignment can see nothing useful. Assets are assigned per Page and per Instagram account, on each asset's detail pane. (Our own @osmanabdout Instagram asset currently has 0 people assigned, including the founder — worth fixing regardless of the link.)

The email problem

Instagram forces a scheme on us that Facebook does not.

One Facebook identity administers every Page. Every Instagram professional account needs its own unique email address — reuse is rejected outright with "Another account is using the same email." Five brands means five addresses that must exist, must be able to receive a verification code, and should not be someone's personal mailbox.

Using personal addresses is what got us here: the accounts are on a hotmail.com address, which means they are personally rather than organisationally held, and they are not recoverable by the company.

Options for <brand>@databayt.org

Cloudflare Email Routing allows 200 routing rules per domain and 200 verified destination addresses per account — vastly more than five brands need, at no cost. It forwards inbound mail to a real inbox you already own; it does not give you a mailbox you can send from.

Recommendation

Cloudflare Email Routing for the signup lane, a real mailbox only where a brand must send.

Every Instagram account needs to receive a verification code exactly once, and then receive security and password-reset mail forever. None of that requires the ability to send. Free, instant, and it puts the addresses on a company domain where they can be re-pointed when people change — which is the actual goal.

Add a real mailbox later, per brand, only when someone needs to answer mail as that brand.

Two things to check before switching:

• databayt.org already handles mail. At least one address on it (hi@databayt.org) is already attached to an existing Instagram account. Enabling Cloudflare Email Routing requires removing the domain's existing MX records and having no other email service active on it — so audit what currently serves databayt.org mail, and where hi@ lands, before touching DNS.
• Moving nameservers to Cloudflare moves all DNS, not just mail. Inventory the existing records first; a missed record takes a site down, and this domain fronts production.

Naming

Whatever scheme is chosen, choose it once and before creating more accounts — changing an Instagram account's email later is possible but changing the scheme means recreating accounts.

ig.<brand>@ is the safer default: one address per brand per platform, so the next platform that demands a unique email does not collide with Instagram's.

Status — 2026-08-19

Publishing no longer depends on a human login.

The Meta app is now Gabriel (874547138717755), renamed from "Hogwarts Social". It carries four Pages across four brands, so naming it after one of them misled every consent dialog a collaborator sees. Verified through debug_token, not the dashboard.

A System User now holds the Page tokens. Gabriel (61593467071204), Admin, created in the portfolio: type: SYSTEM_USER, expires_at: 0, five scopes and no more, with Content and Insights on each Page — so the identity that posts cannot read messages, spend on ads, or delete a Page. hogwarts and mkan were migrated to its tokens and verified by publishing a real post and deleting it.

This resolved an open question rather than assuming it: an Unverified portfolio does issue working System User tokens. Two undocumented gates stand in the way — the portfolio must own the app before a System User can be assigned it, and the System User needs an explicit app role or the permissions picker renders "No permissions available" and dead-ends with no explanation.

A second personal account was considered and rejected. datapayt@gmail.com was invited as a posting account and the invite was revoked the same day: the account turned out to be "Scrape Funnel", created 2026-08-18 as the dedicated scraping identity. Using one account for both lanes would have re-coupled exactly what the scrape doctrine separates — a ban earned while scraping would have taken publishing down with it. It now holds zero roles on any Page, portfolio or app, which is what keeps it cheap to lose. See /docs/scrape.

Correction to "The people" above. Mkan @mkan.sd and UnclaimedBusinessUser FromPool @mkan.sd are listed under People, not System users. Both still hold Full access / Everything — two non-human accounts with total control of the portfolio, neither created deliberately.

A canary now watches the tokens. /api/social/canary probes every publishable brand twice daily and alerts the review channel on a dead or merely expiring token. Page tokens do not announce their own death; before this, a revoked identity surfaced only as brand Pages quietly going silent.

Migration state

Three of four now publish without a human in the token path, each verified by a real post that was then retracted.

Databayt is the holdout, and the cause is now pinned down exactly.

Its Page is claimed by a third business portfolio named "Databayt", id 1364261941941312 — not this one (2243724639760887, which was renamed to Databayt on 2026-08-19) and not "Abdout" (645257771961210, which owns zero Pages). Two portfolios with the same name is why this took so long to see.

Abdout cannot reach 1364261941941312 — business_info?business_id=1364261941941312 returns "this content isn't available… may only be visible to an audience that you aren't in", verified while logged in as his personal account (c_user=668417438). His business selector lists only the other two. So both pending requests — the add (1092185790156133) and the removal — sit with that portfolio's admins, and neither can be approved from here.

Where to find that screen, because it is not discoverable: switch into the Page (profile → Switch Now), then Settings → Page setup → Page access. The bottom section is Business portfolio access and it names the owning portfolio. Business Suite never shows it, and Graph's owner_business needs business_management which our tokens do not carry.

Access finding worth acting on separately. That same screen shows علي أصيل with Facebook access to the Databayt Page carrying Page deletion, Permissions, Content, Messages and calls, Community activity, Ads, Insights — i.e. full control, including the ability to delete the Page. Graph's GET /{page-id}/roles returns only Abdout, so the API under-reports access and must not be used as an access audit. Given the timing, 1364261941941312 is plausibly his portfolio; that is a lead, not a conclusion.

Adding a Page to a portfolio is a checkpointed action: Meta demanded two-step verification mid-flow for balqalam. Expect that, and expect the flow to abandon if the code is not entered.

A teammate came with the Page. Moed Mohamed had access to Bilqalam and was invited to the portfolio at basic access — Meta offers to skip this, but skipping risks stripping the access they already had. That is a second human in the portfolio, though at basic access, so the bus factor is improved rather than fixed: no second person has Full access.

Still open

1. Approve the databayt Page request from the other portfolio, then assign it to Gabriel and re-mint. Only then is the personal grant safe to revoke.
2. The portfolio is Unverified, with no legal name, address, phone or website. (The name is fixed — it is Databayt as of 2026-08-19.)
3. No second human with Full access.
4. The canary has no review destination — nmbdsd_bot is alive but TELEGRAM_REVIEW_CHAT_ID is unset, and Telegram only caches chat ids for ~24h. One message to the bot from the account that should receive alerts makes the id discoverable.

Open decisions

These need a human call, not a default:

1. Rename and legally register the existing Mkan portfolio as Databayt, or create a fresh Databayt portfolio and migrate the assets into it?
2. Resolve the separate "Databayt" portfolio holding the Databayt Page — take control of it, or move the Page out?
3. Who is the second Full-access admin?
4. Cloudflare Email Routing (free, forward-only, moves DNS) vs Namecheap Private Email (paid, real mailboxes, no DNS move)?
5. Which naming scheme?

Tracked in kun#141.