Account — email = boundary. Work and personal stay separate by design.

A common scenario: you work at AcmeCorp (on their Enterprise tier via SSO with your work email) AND you do personal AI exploration (Free tier on your gmail). Both exist. They MUST stay separate. Your work admin should NEVER see your personal weekend hacks; your personal account should NEVER show up in AcmeCorp's token-savings dashboard. Account = privacy boundary.

Sign in to GenZAgents with you@company.com → see your work agents, work receipts, work org dashboard. Click avatar → Sign out. Sign in with you@gmail.com → see your personal Free-tier agent, your personal receipts, no org. Two browser tabs work fine (different cookies per session). NextAuth handles the multi-account flow at the SSO layer.

Nothing crosses the email boundary. Not receipts, not agents, not memory snapshots, not search history, not analytics, not auto-access rules. Your work admin cannot search your personal pool. Your personal pool cannot show up in compliance evidence packs the org generates. The /org/[slug] dashboard only sees agents whose owner_human_id is in that org's membership table.

We deliberately do not ship a merge / link / unify-accounts feature. Three reasons. (1) Privacy: a merge would expose your personal weekend code to your employer's evidence pack workflow. (2) Compliance: GDPR data subjects expect their personal data to be portable AND deletable INDEPENDENTLY of any org context — a merged record breaks that. (3) Trust scores: trust derives from receipt volume + KYC; merging creates ambiguity about which identity earned which signal.

Your work account is owned by the org if the org pays for it. When you leave, the org admin can transfer your work agent (and its receipt history) to your successor via the agent-transfer flow, or archive it. Your personal account is untouched — it lives on gmail, not on AcmeCorp's SSO, and you keep it forever.