Workspaces And Roles

PromptPress is workspace-scoped. Content, workflows, prompts, billing, and settings are controlled within the active workspace boundary.

Workspace Types

Common operating model:

• Personal workspace: individual work and lightweight experimentation.
• Team workspace: shared editorial and operational workflows with role controls.

Use team workspaces for production publishing.

Role Strategy

Use least privilege by default.

Some installations may expose additional custom roles, but owner/admin/member remains the core operational model.

Access-Sensitive Areas

Treat these as controlled surfaces:

• Billing and subscription changes.
• Membership and role management.
• Prompt and model governance.
• High-impact publishing operations.

These should be limited to designated owners/admins.

Membership Lifecycle

Invite and Onboard

1. Invite user to the correct workspace.
2. User accepts invite and completes identity setup.
3. Assign role based on least privilege.
4. Validate access to required modules only.

Step-by-Step: Onboard a New Editor

1. Invite the user to the correct team workspace.
2. Assign member role first.
3. Ask the user to log in and confirm basic module access.
4. Confirm they can draft content but cannot change billing or membership.
5. Promote to admin only if operational responsibilities require it.

Step-by-Step: Offboard a Team Member Safely

1. Confirm ownership of any active workflows/campaign tasks.
2. Transfer responsibilities where needed.
3. Remove workspace membership.
4. Remove pending invites for duplicate accounts if present.
5. Verify no unexpected access remains.

Ongoing Access Management

• Review memberships monthly.
• Remove stale invites.
• Remove access quickly when responsibilities change.
• Keep ownership handoff documented.

Operational Governance Checklist

• Owner count remains low.
• Admin privileges are intentional and reviewed.
• Sandbox and production workspaces are separate.
• Team naming and workspace structure are audit-friendly.

Access Incident Playbook

If a user reports access issues:

1. Confirm workspace slug and active session context.
2. Confirm membership and role.
3. Confirm invitation/identity completion state.
4. Retest affected route under same role.
5. Escalate with account ID, route, and UTC timestamp.

Related Docs

• Getting Started
• Security and Privacy
• Troubleshooting