Teams & roles
A workspace is the tenant boundary. Everything — connections, queries, reports, monitors — belongs to exactly one workspace, and a user only sees what the workspace they are acting in contains.
- Read
- 6 min
- Module
- Teams
Workspaces
One account can belong to several workspaces — an agency managing separate clients, or a company separating production from a sandbox. Switching workspaces reissues your access token scoped to the new one; data never crosses the boundary, and a query saved in one workspace is invisible from another even to the same user.
Roles
Roles are assigned per workspace, not per account, so the same person can be an admin in one and a viewer in another.
| Role | Can do | Cannot do |
|---|---|---|
| Admin | Everything, including members, billing, and workspace settings | — |
| Editor | Create and modify connections, queries, reports, monitors, campaigns | Manage members, billing, or roles |
| Viewer | Read everything; run queries and reports | Create, modify, or delete anything |
| Schedule-only | Pause, resume, and trigger schedules | Read query SQL or modify definitions |
Fine-grained permissions
Beyond the four roles, each workspace has a permission matrix mapping roles to capabilities per feature group — queries, reports, monitors, campaigns, and so on. The matrix is per workspace, so customising it in one tenant never affects another. Admins always hold the full set and cannot be locked out of their own workspace.
Audit log
Every mutating action writes an audit entry: who, what, when, from which address. The log is append-only from the application’s point of view and is scoped to the workspace. Business and Enterprise plans can export it on a schedule to S3 or an SIEM.
SSO and provisioning
Business and Enterprise workspaces can bind a SAML or OIDC identity provider to an email domain, so anyone with an address on that domain signs in through your IdP. SCIM keeps membership in sync, so removing someone in your directory removes their access here.