Workspace members and organizations
Who can grant access, who can change roles, and how revocation works from both sides.
Two different lists
A workspace has members — the people who operate it — and organizations — the contexts it reaches. They are managed separately because they answer different questions: who comes in, and what can be seen from inside.
Roles and who can change them
Members have roles, and only a workspace owner can change someone else's role or remove them. The restriction is not bureaucratic: when admins could do it too, an admin could promote themselves to owner and take the workspace, or remove the existing owners one at a time.
There is also a protection preventing a workspace from ending up with no owner at all. It is complementary, not a substitute — protecting the count of owners says nothing about who is allowed to change it.
Revocation works from both sides
A workspace's access to an organization can be revoked by either side. From the organization's side it is an administrative act — no longer being observed. From the workspace's side it is a management act — no longer observing.
Neither needs the other's agreement, and revocation takes effect on the next read, because the grant is revalidated on every access.