Workspaces and Access
A workspace is the security and billing boundary for Linquid.Role model (practical matrix)
| Role | Typical ownership | Typical allowed operations |
|---|---|---|
| Owner | Account/workspace owner | Full access, billing/plan actions, ownership continuity |
| Admin | Team leads/operators | Most management actions across links, campaigns, rules, members, integrations |
| Editor | Campaign operators | Build and operate campaigns/links/rules, review analytics, limited governance actions |
| Viewer | Analysts/stakeholders | Read-only dashboards and operational visibility |
Permission design principles
- Grant the lowest role that still allows the user to complete their job.
- Separate billing/governance duties from campaign operation where possible.
- Use temporary elevation instead of permanent over-privileged access.
- Review and revoke access as part of every offboarding workflow.
Workspace settings areas
Key workspace-level controls include:- identity: workspace name, logo, branding defaults
- operations: default workspace behavior and member lifecycle
- developer controls: API keys and publishable keys
- domain controls: custom domain setup and validation
- governance: limits, retention, and ownership continuity
Invitation and membership lifecycle
Common membership flow:- Invite one or more emails from the Members tab.
- Set role at invite time.
- Invitee accepts and appears as active member.
- Admin/owner adjusts role as responsibilities change.
- Member is removed when access is no longer required.
- Batch invite is supported for multi-email onboarding.
- Invite quality matters: wrong role assignment is the most common access bug.
- Removal prompts should be treated as irreversible from an access perspective.
Member onboarding checklist
- Invite to the correct workspace with correct role.
- Confirm accepted invite appears in member list as active.
- Confirm user can access required pages only.
- Confirm user cannot access admin/billing pages unless intended.
Access controls
Use workspace roles and scoped permissions to enforce least privilege. Common patterns:- Operators: campaign/link/rule management.
- Analysts: read-focused access for analytics and exports.
- Owners/admins: billing, integration, and workspace governance.
Scope isolation expectations
Users should never see resources from a workspace they are not a member of. This includes:- links, campaigns, and rules
- conversions, events, and customers
- affiliate and payout data
- exports and workspace-level settings
- Affiliate partners in the partner portal are separate identities and are not workspace members by default.
- Partner portal access and workspace-member access are governed by different authentication and permission paths.
Multi-workspace behavior
For users in multiple workspaces:- Active workspace controls visible data scope.
- Personal default workspace setting controls initial landing context.
- Switching workspace should immediately switch all analytics, links, and billing context.
Default workspace best practices
- set a stable default workspace for each user role.
- verify mobile and desktop load the same default.
- include workspace context checks in onboarding docs.
Permission boundary expectations
A user should only see data for workspaces they belong to with sufficient role access. This applies consistently to:- analytics and dashboard views
- campaign/link/rule management
- customer, conversion, and affiliate data
- export and billing operations
Identity and login interaction
Access can be tied to:- email/password credentials
- linked social providers
- enterprise SSO (when enforced by workspace)
Common access issues and fixes
| Issue | Likely cause | First fix |
|---|---|---|
| User cannot see expected pages | Role too restrictive | Update role and retry |
| User sees wrong workspace after login | Default workspace misconfigured | Update default workspace preference |
| Invite not accepted | Incorrect email or expired invite | Reissue invite to correct address |
| Billing page unavailable to admin | Role/workspace mismatch | Confirm user role in the active workspace |
| SSO user cannot log in | Domain enforcement or IdP mapping issue | Validate SSO config and domain association |
Operational checks
Run monthly checks for:- stale invites
- inactive members
- over-privileged users
- ownership continuity
- default workspace correctness for multi-workspace users
Quarterly governance checks
- Audit all owners and admin users for necessity.
- Remove stale invited users and dormant members.
- Validate SSO/SCIM membership mapping for enterprise tenants.
- Review permission exceptions and temporary escalations.
- Confirm offboarding checklist includes session revocation.
/user-guides/manual/workspace/workspace-onboarding-and-governance-playbook/user-guides/manual/workspace/security-and-compliance/user-guides/manual/monetization/billing-plans-and-credits