There is no way into this workspace but the one that made it. A verified sign-in with no membership row is given a brand new workspace of its own, so today every workspace has exactly one member and inviting a second one would need a join path that does not exist yet.

When it does exist, an invitation is a governed act like any other: it lands on the audit chain with who asked and who accepted.