Workspaces & Roles
Workspaces
A workspace is the container for all content: ideas, posts, prompts, examples, publishing slots, action requests, and per-workspace settings (target audiences and languages). A user can belong to several workspaces and switch between them; data never crosses a workspace boundary.
Workspace owners can invite members. Invitations to people who are not yet platform users are delivered by email (via SES); existing users are added directly.
Roles
Access within a workspace is governed by role-based access control (RBAC):
| Role | Capabilities |
|---|---|
| Owner | Full control: manage members, settings, publishing slots, and all content. |
| Editor | Create and edit ideas and posts, generate and iterate with GenAI, create action requests. |
| Viewer | Read-only access to workspace content. |
Beyond workspace roles, a small set of platform admins approve new user signups and manage users across the platform. Admin capabilities are separate from workspace roles.
Registration & approval
New signups (Google or email/password) are created in Cognito but cannot use the app until
a platform admin approves them. Approval state is stored in DynamoDB (approved: true) and
enforced by a pre-token-generation Lambda trigger and the API authorizer, so an
unapproved user's tokens are rejected at the edge. The same approval gate protects the
MCP server.