Skip to content
teams
Administration

Teams & roles

A workspace is the tenant boundary. Everything — connections, queries, reports, monitors — belongs to exactly one workspace, and a user only sees what the workspace they are acting in contains.

Read
6 min
Module
Teams

Workspaces

One account can belong to several workspaces — an agency managing separate clients, or a company separating production from a sandbox. Switching workspaces reissues your access token scoped to the new one; data never crosses the boundary, and a query saved in one workspace is invisible from another even to the same user.

Isolation
Every tenant-scoped record carries a workspace id, and reads are filtered by it at the data layer rather than per endpoint.
Switching
Changing workspace issues a fresh token. An old token cannot be replayed against the new workspace.

Roles

Roles are assigned per workspace, not per account, so the same person can be an admin in one and a viewer in another.

RoleCan doCannot do
AdminEverything, including members, billing, and workspace settings
EditorCreate and modify connections, queries, reports, monitors, campaignsManage members, billing, or roles
ViewerRead everything; run queries and reportsCreate, modify, or delete anything
Schedule-onlyPause, resume, and trigger schedulesRead query SQL or modify definitions
Running a query is intentionally available to viewers — a read-only analyst still needs to get numbers out. What viewers cannot do is change what a query is.

Fine-grained permissions

Beyond the four roles, each workspace has a permission matrix mapping roles to capabilities per feature group — queries, reports, monitors, campaigns, and so on. The matrix is per workspace, so customising it in one tenant never affects another. Admins always hold the full set and cannot be locked out of their own workspace.

Per-group verbs
Read, create, update, delete, plus operational verbs like run and send, granted independently per feature group.
Column policies
Mask or block specific columns for specific roles, so a viewer can read a table without seeing the PII column in it.

Audit log

Every mutating action writes an audit entry: who, what, when, from which address. The log is append-only from the application’s point of view and is scoped to the workspace. Business and Enterprise plans can export it on a schedule to S3 or an SIEM.

What is recorded
Creates, updates, deletes, permission changes, sends, and logins — including failed ones.
Retention
Follows the workspace log-retention policy under Settings → Data policies.

SSO and provisioning

Business and Enterprise workspaces can bind a SAML or OIDC identity provider to an email domain, so anyone with an address on that domain signs in through your IdP. SCIM keeps membership in sync, so removing someone in your directory removes their access here.