# Workspaces and accounts

Understand workspace isolation, agency and client ownership, permissions, billing, and runtime resources.

A workspace is the primary boundary for data, permissions, API keys, agents, integrations and usage.

## Workspace types

| Type     | Purpose                                                | Billing owner |
| -------- | ------------------------------------------------------ | ------------- |
| Standard | Regular company or team workspace                      | Itself        |
| Agency   | Manages its own agents and client workspaces           | Itself        |
| Client   | Isolated customer or project workspace under an agency | Parent agency |

Client workspaces separate agents, deployments, runs, files, integrations and members while preserving centralized agency billing.

## What belongs to a workspace

| Resource               | Notes                                                |
| ---------------------- | ---------------------------------------------------- |
| Agents and deployments | Stable agents with immutable versions                |
| API keys               | Account-scoped programmatic authority                |
| Runs and turns         | Durable runtime execution records                    |
| Files and artifacts    | Authorized run outputs                               |
| Integrations           | Slack, Teams and workspace-level operations settings |
| Members                | Users and workspace permissions                      |
| Usage                  | Attributed to the originating workspace              |
| Billing                | Managed by the billing-owner workspace               |

## Billing ownership

Runtime access is checked against:

```text
standard workspace -> itself
agency workspace   -> itself
client workspace   -> parent agency
```

Client workspaces do not manage billing directly. Their usage is attributed to the client where supported and charged to the agency billing owner.

## Authority

User actions and API keys are limited to their workspace.

Use separate keys per integration and environment. A key created in one workspace cannot call an agent belonging to another workspace.

Billing, member management, API-key management, integrations and operations settings require the corresponding workspace permission.