Workspaces overview
How a group views several organizations without mixing data or billing.
Who it is for
A workspace is the layer for anyone administering more than one organization: a group, a holding company, a consultancy serving several clients. Instead of switching accounts per organization, you grant access to them inside a workspace and move between contexts.
It is an Enterprise plan capability, billed to the organization that founds the workspace.
Home organization and active organization
This distinction explains almost everything about the layer. Your home organization is your identity: the subscription, the seats, and the AI quota belong to it, and it never moves. The active organization is where you are looking right now, which may be a different one, reached through a workspace grant.
Everything operational — suppliers, risks, assessments, reports — answers to the active organization. Everything about billing, seats, or plan limits answers to home. Taking on another organization's context does not change your invoice, and it should not.
The grant is revalidated, not trusted
The pointer naming the active organization is not accepted on its own. On every database read the grant is revalidated, and a stale or tampered pointer simply falls back to the home organization — the check happens inside the isolation layer itself, not in an application check somebody could forget to call.
In practice that means revoking access takes effect immediately, without waiting for a session to expire.