Creates their account and emails an invitation that doubles as address confirmation. They sign in with a one-time code — no password. Inviting someone as a verified sysadmin vouches for them, so they have access immediately.