Payroll access granted contract

Purpose/audience: The invited collaborator receiving payroll access (invite user_email).

Implementation: App\Mail\GrantPayroll. Baseline view: resources/views/emails/users/GrantPayroll.blade.php. Usage evidence: app/Http/Controllers/Settings/invitationsController.php:1918. These are static references, not proof of current production delivery.

Suggested subject: Payroll access. HTML title alone does not set the mail header.

Suggested preheader: {{business_name}} has given you payroll access on Built.

Portable placeholder contract

Token	Existing source / derivation	Requirement
{{logo_url}}	Existing Built app_name PNG	Optional deployment override; the concrete project HTTPS PNG is the default. Approved HTTPS or matching CID only.
{{preheader}}	Suggested text above, assembled only from already available values	Required escaped text; not a new backend record or processing guarantee.
{{business_name}}	$business->name	Required escaped business identity; do not substitute the recipient name.

Content, states and integration decisions

Preserve the explicit ability to create employees and payruns on behalf of the business. Do not translate that into permission to pay staff, approve payments or manage unrelated business functions.
There is no supplied action URL or recipient first name. The message stays informational with no invented login/details button. Business identity remains in the body.
The caller queues this Mailable. Preserve business From and business-email-or-owner Reply-To. States: standard and long business name.

Portable HTML/text and safe handling

ready/payroll-granted.html and ready/payroll-granted.txt provide the portable extracts. Every populated state has matching .html and .txt files under previews/. All sample links are local design explanations; no real invitation, report or account action is executed. Placeholder {{names}} are not automatically Laravel Blade syntax. Convert each mapping explicitly using existing data and server-side URL generation; retain all required values and do not insert untrusted raw HTML.

Escape text and attribute values. Validate any application/CFO AI URL separately against approved HTTPS hosts before escaping it; preserve complete generated links and encrypted/signed parameters. Use the provided concrete public PNG or an approved HTTPS/CID override. There are no hidden optional content sections to populate here; required identities/counts should not be silently omitted. Unsupported data has not been invented.

All drafts use the approved compact transactional shell with 16px body text, a minimal Built footer and native light/dark CSS. Email-client rendering and blocked-image behavior remain separate tests. See integration-notes.html for shared provider/image limitations, and easy-wins-batch.md for the whole batch. No production template, sender, transport or application behavior is changed.