Workspaces & tenancy

A workspace is the unit of tenancy. Everything belongs to exactly one workspace.

Membership & roles

Users join a workspace via membership. Operators (members) access the portal; the workspace owner is set at provisioning. Invite teammates from the portal.

Isolation (RLS)

Every workspace-scoped table enforces row-level security keyed on workspace_id (current_user_workspace_ids()). Writes go through a service-role service layer that stamps workspace_id (ADR-0001/0004). Secrets (payment keys, BYO email keys) have no select policy — service-role only.

Settings

Free-form per-workspace config lives in workspace settings (key/value) — e.g. email_from. Manage under Settings → Business settings.

Billing

New workspaces start a 14-day trial. Subscriptions are handled via the billing module.