Workspace Architecture

Understand the data model, entities, and role-based access control behind AskUI workspaces

Data Model Overview

The following Entity Relationship Diagram shows how the core entities of the AskUI workspace service relate to each other. User identity is managed externally via Auth0.

Entities at a Glance

Entity	Purpose
User	Identity record managed in Auth0 (email, name, profile picture).
Workspace	Organisational container that groups members, tokens, and usage.
Workspace Membership	Join entity that links a User to a Workspace and carries the assigned role.
Workspace Access Token	Scoped credential tied to a specific membership (user + workspace pair).
Usage Event	Consumption record associated with a workspace for billing purposes.

Role-Based Access Control

Every workspace membership carries exactly one privilege that determines what the member is allowed to do. The three roles form a strict hierarchy:

Permission Matrix

Capability	Owner	Admin	Member
Use platform functionality	✅	✅	✅
View workspace resources	✅	✅	✅
Manage workspace resources & settings	✅	✅	❌
Add / remove non-Owner members	✅	✅	❌
Add / remove Owners	✅	❌	❌
Manage subscription & billing	✅	❌	❌
Delete workspace	✅	❌	❌

A member’s role cannot be changed after assignment. To change a role you must remove the member and re-invite them with the desired role.

How Roles Are Assigned

1. The user who creates a workspace automatically receives the ROLE_WORKSPACE_OWNER privilege.
2. When an existing member invites a new user, they select the role at invitation time.
3. The invited user accepts the invitation and a WorkspaceMembership with the chosen privilege is created.

Access Tokens

A Workspace Access Token is a scoped credential tied to a specific membership (user + workspace pair), typically used to authenticate API calls in CI/CD pipelines. Tokens support an optional expiration date and deleting a token takes effect immediately with no grace period.

Your API credentials consist of your Workspace ID plus an Access Token. See Token Management for step-by-step instructions.

Next Steps

• Members Management: Invite members, assign roles, and manage your team
• Token Management: Create and manage access tokens
• Usage & Billing: Monitor workspace consumption and billing