Users & Spaces
A space is a separate work area with its own data and settings; a user is a login inside one. These two screens are how people get in and how a space is bounded.
Where to find it
| Screen | Where it lives | What it is for |
|---|---|---|
Users — /admin/users | Settings → Workspace & access → Users | the people in this space, and their invitations |
Spaces — /admin/spaces | Settings → Workspace & access → Spaces | the spaces you can reach, their ceilings, plans and domains |
Each page has a view permission of its own, and each action on it has its own narrower one. Opening a page you can only read says so: view only — to change users here you need the "Create users", "Enable or disable users", "Assign role groups" or "Reset passwords" permission. The level-2 actions ask for your password first.
Users
Every user is backed by a contact
That is the model, and it explains the first choice when adding somebody: link an existing contact, or create one inline. Either way the contact gets the user role and a login. There is no such thing here as a login with nobody behind it.
The list shows Username (email), the Contact, Role groups, whether the user is Enabled, and Last login.
Inviting somebody by email
Invite by email… is the preferred way in, because no password is ever shared: the person receives a one-time link and sets their own.
| Field | What it does |
|---|---|
| an address already known as a login means that existing person joins with their own login; a new address creates an account here | |
| Rights on acceptance | the permission groups applied the moment they accept |
| Link valid until | when the link stops working |
| Message | optional, shown to them |
| E-mail locked | only this address may accept — a logged-in person cannot attach the invitation to a different account they already have |
Invitations are listed with their Status — Pending, Accepted, Expired or Revoked — and the controls on a row follow that status: Edit on a pending invitation, and Resend (which invalidates the previous link) and Revoke (the link stops working immediately) on a pending or an expired one. An accepted or revoked invitation carries no controls. There is no copy-link button on the row: the link is offered in the dialog that follows sending or resending, and only when e-mail delivery is not configured.
Role groups, and the ceiling you can feel from here
Assigning groups to a user shows two honest numbers: how many of the group's permissions apply here, and which of them are outside this space's ceiling. Groups outside the ceiling can still be assigned — the assignment is kept — but they resolve to nothing in this space, and the page says so rather than letting you believe you granted something.
The note tells you where to fix it: this space's ceiling admits only … — a parent-space admin widens it under Admin → Spaces → this space → Ceiling.
Resetting a password
Reset password emails a reset link, and the confirmation says the part people worry about: their current password keeps working until they redeem it. If the user's contact has no primary email address, the page says to add one first.
Impersonation
Impersonate lets an administrator act as another user. The confirmation says what makes it acceptable: every action is audited with your identity attached, and a banner is shown throughout so you can stop. For a user in a space you are not a member of, you cannot simply enter — you request access, giving a reason, and the person must approve it; they pick the final duration and scope. Requests are tracked under Account → Access grants.
Spaces
The list is your reachable subtree: the space you are in and the spaces below it. Each row shows Users, Ceiling, Billing and whether it is the Current space.
Creating a space
A new space is created under the space you are in, with a permissive ceiling so nothing starts hidden. You pick an origin contact and a plan, and three things happen at once: the contact is shared into the new space as a live-synced copy, billing is provisioned on the plan, and that contact becomes the first user (a space admin) with an invitation.
Optionally the space can start from a template set — a main template plus sub-templates. Preview the set and resolve every conflict before creating the space. See Templates.
The ceiling — the one concept to understand
The ceiling is the parent's control over what this space can ever resolve: every user's effective permissions are intersected with the union of the ceiling groups' grants. It binds everyone in the space, including super admins.
So a ceiling is not a default and not a suggestion. It is the outer boundary, and nothing inside the space can exceed it.
Each row's ceiling reads Full menu, or MISSING — deny-all, or shows the groups attached. To narrow a space: attach a hand-built group granting only the keys you want to admit, then remove the permissive default. Two refusals protect you from locking a space out of existence:
- a set that would leave the ceiling empty (deny-all) is refused;
- dropping the last group that admits user administration is refused, so a space always stays self-administrable.
A child you narrowed can always be re-widened.
If a group is assigned to members but sits outside the ceiling, the page says so: members keep the assignment, and it admits nothing here until the ceiling is widened.
Linking a person into a space
Link user… adds an existing person as a member of this space. The note explains what kind of thing that is: a linked local user for an existing person — access is an auditable row, never ambient. No credentials are created; they sign in as themselves and reach the space from the space switcher.
New user… does the other thing: creates a user that belongs to this space only, with its own contact and its own login, unconnected to any parent-space identity. They set their password through an emailed one-time link.
Orphan spaces
Spaces with no users or no owner are listed separately. Assign origin… does the same one-time provisioning a new space gets: shares the contact in as a live-synced copy, provisions billing on the chosen plan, and mints the first user. A space that already has users is left alone — its disposition is an operator's decision, and the row says so.
Custom domains
A space can be reached at your own address. Add a domain, mark it Verified, and set one as Primary. Routing is provisioned immediately; the certificate is ordered automatically on the next renewal pass, and the row shows whether it is issued, pending or expiring.
Sandboxes
A space can be cloned as a Sandbox for safe experimentation. Delete sandbox removes every row copied into it and deletes the space. The confirmation is blunt about the consequence: workflows authored in it are not promoted, and this cannot be undone — clone the live space again for a fresh sandbox.
Billing and the reseller chain
Each space's drawer carries its billing account, its subscriptions, its plan catalogue and (where granted) its reseller rights. Those are explained in Billing & Plans.