Workspace and members
The workspace is your tenancy. It owns the members, the billing, the phone numbers, and the agents.
A workspace is the container everything else lives inside:
- Members and their roles (covered below).
- Billing. One pay-as-you-go account for the whole workspace.
- Phone numbers. Numbers live in a workspace pool, then get assigned to an agent.
- Agents. Each agent is workspace-scoped: its prompt, tools and knowledge base belong to it, and it belongs to the workspace.
One workspace can hold many agents. You get one when you sign up and can create more. A person can belong to several at once.
Agent handles
Every agent is addressed as workspace-slug/agent-slug, so the workspace slug
is part of the identity of everything inside it.
acme/front-desk the agent front-desk, inside the workspace acmeMembership is the unit of access
Membership grants access to the agents inside a workspace, subject to your role. Nothing is owned by a single person: it is owned by the workspace, and members act on it.
To give someone one agent rather than the whole workspace, add them as a collaborator.
Members and roles
Each member has exactly one role: owner, admin, editor or viewer.
- Owner and admin manage the workspace: billing, members, settings, audit logs, skills and connectors.
- Owner, admin and editor build: create, edit and publish agents.
What each role can do
| Role | Build agents | Invite and remove members, change roles | Billing | Workspace settings, audit log | Transfer or delete the workspace |
|---|---|---|---|---|---|
| Owner | Yes | Yes | Yes | Yes | Yes |
| Admin | Yes | Yes | Yes | Yes | No |
| Editor | Yes | No | No | No | No |
| Viewer | No | No | No | No | No |
Details behind the table
- Owner: the workspace's single legal and billing contact. Can do everything an admin can, plus transfer ownership and delete the workspace.
- Admin: day-to-day administrator: members, billing, settings and keys, plus building agents. Cannot delete the workspace or take the owner role.
- Editor: builder role. Creates, edits and publishes agents. Cannot touch members, billing, settings or keys.
- Viewer: read-only.
The default role for new invitations is editor. Reserve admin for people who should manage billing, members and settings.
Roles are enforced on the server. The same limits apply whether a member acts through the app, the API, or a connected assistant.
Members are managed under Settings > Members by an owner or admin. See Managing members.
Sharing one agent instead
Membership gives a person the whole workspace. A collaborator reaches a single agent through a focused view that hides the rest of the workspace. The two access levels and their limits are on Collaborators.
Add collaborators from the agent's Share section. Choose a collaborator for a client, contractor or stakeholder who should only touch one agent.
Workspace settings
Workspace settings are owner and admin only. Two shape how the workspace is identified:
- Name. The workspace's display name. Changing it is cosmetic; nothing that points at the workspace breaks.
- Slug. The workspace's stable identity in URLs and in every agent handle
(
workspace-slug/agent-slug). A slug is lowercase letters, numbers, and hyphens, and must be unique across the platform.
Changing the slug rewrites every agent handle, share link, and bookmarked URL in the workspace. Anything that still addresses the old slug stops resolving. Change the name freely; change the slug only when you mean to.
The same area holds data and privacy controls (transcript retention, PII scrubbing). See Privacy.
Assistant connector scopes
The MCP server signs you in through a browser authorisation flow. The token carries a set of scopes on top of your workspace access.
| Scope | Allows |
|---|---|
agent:read | Read agents and their configuration. |
agent:write | Create and edit agents (the non-destructive changes). |
agent:delete | Destructive agent actions, such as deleting. |
workspace:admin | Workspace-level administration, such as members, settings, and keys. |
Scopes narrow what the connector may attempt; they never widen it. Every operation still runs as you.
See Connect your assistant for setup and Access control for enforcement details.