Skip to main content

Organizations, Teams and Workspaces

How Decision Terrain is organized​

Decision Terrain is built for organizations. Every account, agent, secret and usage record lives inside an Organization, the company boundary for identity, membership, seats, licensing, policy, and enterprise SSO. There is no separate individual account outside an Organization.

LevelWhat it is
OrganizationThe company. It owns membership, seats, the license, policy, and SSO configuration.
TeamAn optional shared workspace for a defined group or project. A Team belongs to exactly one Organization, and an Organization does not need a default or "General" Team.
My workspaceEach member's own space inside the Organization, shown as My workspace and governed by company policy.
AgentBelongs to a member's My workspace or to a Team.

Joining an Organization​

Public registration is closed by default. People join an Organization by invitation, through enterprise sign-in, or by directory provisioning. Enterprise SSO can enroll people just in time, and Directory Provisioning manages membership from your identity provider. Each active member takes a seat. SSO enrollment never assigns Teams automatically, so add people to Teams explicitly. See Joining an organization for how invitations work.

The first Owner sets up the Organization. Until a signed company license is imported, the Organization can be set up but agents cannot execute work. See Seats and licensing.

Workspaces and access​

My workspaceTeamOrganization
Agent accessThe member and Organization administratorsAssigned Team members and Organization administratorsCompany-wide oversight and policy
Secrets and integrationsThe member's private reusable valuesTeam-shared valuesOrganization-wide values
MembershipEvery Organization memberOptional Team roles: Admin, Member, or ViewerCompany roles and delegated administration
License and usageCovered by the Organization licenseCovered by the Organization licenseOne license and usage view per Organization
SSOInherits Organization policyInherits Organization policyConfigured and enforced here

An agent with an Organization and no Team is in its creator's My workspace. Organization administrators can see and administer it for company oversight, but ordinary Organization members cannot.

An agent with a Team is shared with that Team. Organization Owners, Admins, and Agent Admins have implicit full Team access. Other members must be assigned to the Team as Admin, Member, or Viewer.

Create a Team for work that should be shared with a defined group. Everyone already has a My workspace, so there is no need for a placeholder Team.

Roles and permissions​

Organization roles include Owner, Admin, Identity Admin, Security Admin, Agent Admin, Auditor, License Admin, Member, and Viewer. They separate company administration, identity, security, agent operations, licensing, and ordinary resource access.

Use Roles And Permissions for the complete role table, Team access, and role-change boundaries. Specialized administrators do not automatically receive access to every agent or control.

Seats and licensing​

One signed company license covers the Organization, including My workspace and Team workspaces. Every active human member, including Owners and Viewers, consumes a licensed seat. Valid pending invitations reserve seats; acceptance consumes its reservation once. Agents, Teams and service credentials do not consume seats. A smaller signed replacement preserves existing members while blocking additions above capacity.

Active members can inspect the license; Owners, Admins and License Admins can import replacements. Review occupied, reserved, available and excess seats in Governance → License.

Before adding seats, consider:

  • Who needs full membership versus collaborator access to a single agent
  • Whether seasonal or temporary members need seats

Moving agents between workspaces​

When you move an agent from My workspace to a Team, or between Teams, review:

  • Charter and personality: Remove references to one person's context
  • Secrets and credentials: A member's private secrets stay with the member. Use Team or Organization secrets for shared work.
  • Contacts and channels: Ensure outbound contacts are appropriate for the Team
  • Connected apps: Verify integrations still authenticate correctly after the move

Organization-scoped resources​

Organizations unlock several shared resources:

Secrets and integrations​

My workspace, Team, and Organization scopes are explicit. Organization resources are inherited by the company's member and Team agents; Team resources stay within that Team, and private resources stay under the member's control inside that one Organization. A person who belongs to multiple Organizations has an isolated private credential and integration scope in each. See Global Secrets.

Organization MCP servers​

Ordinary Organization MCP servers require explicit agent assignments. Product-managed integrations can be inherited by eligible agents in their owning workspace instead; credentials and runtime availability still apply. See Organization MCP Servers.

Communication policy​

Contact allowlists and communication endpoints belong to individual agents. Organization policy can impose email-review requirements and contact restrictions, but membership alone does not grant contact access to every agent. Review each agent's contact permissions.

Usage​

Usage rolls up across Organization agents. Use Usage to inspect consumption and Governance → License to inspect validity, human seats and renewal. See License and Usage for details.

Managing your organization​

Organization management happens in the platform console at https://your-deployment.example/app/governance/overview. The admin guide covers day-to-day operations:

Next steps​

Last updated on