A workspace holds a team’s rules and rule sets, its check log and evidence, its connectors and tool mappings, and its members. A key or token belongs to exactly one workspace, and can’t read or check another’s. See Workspace isolation.

​
Roles

Three roles. “Owner” in these docs only ever means a rule’s owner: the person whose name is on a rule and who answers its asks. Anyone can own a rule, whatever their role.
The roles used to be called owner / expert / member. For one more release the API still accepts those names on input (owner = admin, expert = editor) and always answers with the new ones.

​
Manage it

On Account (/account):
  • switch workspace, or create one (up to 20 you own);
  • invite by email with a role: the invite becomes a membership when that address signs in. People without a Claros account get an invitation email from WorkOS; people who already have one just sign in;
  • change roles, remove members, or leave. A workspace always keeps at least one admin.
The first sign-in of an address listed by the server’s operator as an admin makes it an admin of the built-in default workspace.