Organizations & Workspaces

Confluye organizes accounts into organizations and workspaces. Organizations hold membership, identity settings, and usage across their workspaces. A new personal organization is named Organización de <account name>; when the account name is empty, Confluye uses only the part of the email address before @. An organization Owner can change that display name in Settings → General without changing its slug, memberships, or workspaces. A workspace is the isolation boundary for its workflows, schedules, credentials, tables, documents, knowledge bases, and API keys.

Workspaces

Workspace resources and explicit memberships belong to one workspace. A workspace also belongs to exactly one organization, recorded by its organizationId. Switching workspaces changes the active context. A workspace API key remains scoped to its own workspace; GET /api/v1/workspaces returns only that key's workspace.

Every active organization member receives an explicit Member membership in the organization's shared workspaces. Existing shared workspaces appear automatically when an invitation is accepted, and a newly shared workspace is granted to existing organization members. Member access can edit workspace content and run automations; promotion to Admin is only for administrative actions such as managing members and settings. A private workspace otherwise requires an explicit workspace assignment. When the certified derived-access rollout (FLUXUS_WORKSPACE_DERIVED_ACCESS) is enabled, organization Owners and Admins also receive read-only oversight of private workspaces; that oversight does not grant editing, execution, or member-directory access.

The workspace directory refreshes when you return to it or reopen the switcher. Its Showing workspaces from control starts at All organizations, so accessible workspaces from every organization remain visible. Select one organization there, or at the top of the sidebar workspace switcher, to narrow the list. New workspace opens a separate creation dialog. It defaults to the organization currently shown, or to the active organization while all organizations are shown. Choose Shared with the organization when every member should be able to open it, or Private when only people you add should have access. If you belong to one organization, the dialog shows that organization as read-only text. The members panel follows the selected directory organization, or uses the active organization while the directory shows all organizations. The active organization appears beneath the active workspace when you belong to more than one. Duplicate organization names keep their display name on the first line and add the owner's account name on a muted second line. If the owner name also matches, the label adds the creation date and, only as a final tie-breaker, a short ID fragment.

Invite to the organization, then manage private access

An organization Owner or Admin invites a person from the Organization page. When the invitee accepts, Confluye adds them to every shared workspace as a Member. Private workspaces otherwise remain hidden until a workspace Owner or Admin explicitly assigns access. Under the certified derived-access rollout, organization Owners and Admins retain read-only oversight without receiving an explicit assignment.

To withdraw a pending invitation, an organization Owner or Admin chooses Cancel beside its Invitation pending badge and confirms Cancel invitation. The row disappears and the emailed link can no longer be accepted. If cancellation fails, the row stays visible with an inline error. An invitation whose link already expired can still be canceled to clear it from the list. Accepted or already canceled invitations cannot be canceled; removing an existing organization member is a separate action.

From MCP, use organization-invitations.list and organization-invitations.cancel with a write-capable connection. The same organization Owner/Admin opens the returned approval link, verifies MFA and reviews the exact request before the MCP client continues. Workspace ownership alone does not grant this authority. See Organization invitations and Checkout.

For a private workspace, a workspace Owner or Admin opens Settings → General → Access and uses Add a member to select an existing organization member. The searchable, paginated selector supports large organizations and shows only people who do not already have an explicit assignment to that workspace. The workspace admin then assigns Member, Admin, or Viewer. Automatically added shared-workspace members already have a Member assignment, so promote one with the role control in Assigned members, not the add-member selector. Workspace ownership can be managed only through the dedicated ownership transfer action.

When FLUXUS_WORKSPACE_DERIVED_ACCESS is enabled, organization Owner/Admin oversight of a private workspace does not let them assign members unless they also have the workspace's explicit Owner or Admin role. Derived organization reads do not reveal the workspace's member directory.

The session tRPC procedure workspaceShell.workspaceMembers.assignable provides this directory to workspace Admins and Owners. It accepts optional query, cursor, and limit fields. The query searches names and email addresses; results are ordered by organization-membership ID and return { members: [{ id, name, email }], nextCursor }. workspaceShell.workspaceMembers.invite assigns an existing organization member. It does not send a second invitation. An external person must first be invited to and accept the organization invitation.

The assignment API POST /api/v1/workspace-members likewise requires a workspace-scoped API key with Admin or Owner authority and an active organization membership. If the person is not yet an organization member, it returns 409 organization_membership_required without creating an assignment. GET /api/v1/workspace-members lists explicit workspace assignments.

Organization structure

Organization Owners and Admins can compare retained usage in Consumo y costos by workspace, workflow and responsible user, then drill into AI nodes and invocations. Name-based filters and daily comparisons help find where consumption concentrates. Actual compute credits, estimated Claude/Codex costs and informational credit equivalents remain separate; missing measurements are identified. This report preserves historical attribution and does not grant private execution-content access. See Usage, budgets, and alerts.

Organization membership and workspace membership are separate records with separate roles. Adding or changing an organization role does not overwrite explicit workspace roles. Shared-workspace Member memberships are synchronized from active organization membership; private-workspace access is assigned deliberately. Removing someone from an organization revokes their workspace memberships in that organization.

Once the initial shared-workspace grant is complete, later sign-ins respect deliberately removed workspace assignments.

Organization creation and deletion are not self-serve. Platform bootstrap and Google personal workspace provisioning are automated creation paths. Organization identity settings such as its display name, SSO, and SCIM are configured once for the organization. Only an organization Owner can rename it; Admins and Members see the name read-only in Settings → General.

Role details: Roles and permissions. Settings: Workspace settings. Governance roles are separate from organization and workspace roles: AI governance.