I saw another comment which said this wasn't quite the case. https://news.ycombinator.com/item?id=34193624 https://news.ycombinator.com/item?id=34193624 Even i

I saw another comment which said this wasn't quite the case. https://news.ycombinator.com/item?id=34193624 https://news.ycombinator.com/item?id=34193624 Even if it is the case, it is still an issue because it can be used for abuse. If you wanted to pin abuse on someone you just need to add them to the project doing something illegal. Google tends to be trigger happy about banning so it could affect someone. I bet there are avenues for companies to deal with a situation like this, but it still affects individuals which is a big problem. Especially if your personal account gets banned. I'd also argue that it's a spam issue for companies (albeit less than it is for individuals). You may not see it by default for companies, but it will still appear in some lists throughout the UI probably. I think honestly both AWS / GCP should ask for permission to be invited when you're adding someone outside your company.