The caller's own role in it — what the dashboard hides and shows against.

Whether this organisation's access is withdrawn — the paywall's whole input, as the read the console makes first. While it is true the gateway answers 402 to every operation except this one, /me, /orgs and the active-org switch; mail keeps arriving, nothing can be opened or changed, and an owner or admin restores it from billing. A person may belong to several organisations, so this is a fact about ONE of them, never about the caller.

⛔ DERIVED from entitlement, in one place, by the service that owns the row — never a second fact somebody sets. The two cannot disagree because nothing produces one without the other.

active · past_due · suspended.

Only suspended withdraws access. past_due is a biller's "the payment failed" and is a warning the console renders, not a switch — a card that expired on a Tuesday should not read as a service that was turned off. Which failed payment becomes a suspension, and when, is a biller's policy: nothing in the service reads a clock. The Platform document carries the same vocabulary on the operator's Entitlement; this is the founder's read of it.