One installation, one client per workspace
An agency running eleven client sites does not want eleven CMS installations to patch, and cannot have one shared pile of content. A workspace is the line between those two — its own content, its own members, its own dashboard, in the same deployment.
For agencies, and for teams with more than one brand
Monday, at an agency
A new designer joins and needs access to three of your eleven clients. You add them to three workspaces. They sign in and see three — not eleven with eight greyed out, and not a list they could page through to learn who your clients are. The workspace list is scoped to membership, so it cannot be used to enumerate anything.
Membership and permission are two different questions
Membership decides where you may act. Permission decides what you may do. Both have to pass, and neither substitutes for the other — holding workspaces:update does not give you reach into a workspace you do not belong to, and being a member of one does not let you do anything your role does not allow.
Every workspace-scoped route carries both guards. One resolves the workspace from a header, which is what the content and media plugins use; the other resolves it from the URL, which is what the workspace’s own routes use. Both delegate to the same function, so what "has access" means cannot drift between them.
A non-member gets a flat 403, never a 404. "Not a member" and "no such workspace" are deliberately indistinguishable, so the routes leak no ids to somebody guessing.
A workspace is granted content types, not just content
Each workspace holds grants naming which content types exist inside it. A client workspace that was granted articles and authors has no route to another client’s product catalogue, because that type is not part of it — the isolation is at the level of the model, not a filter on a shared list.
Entries carry their workspace on every row and every query is scoped by it, so there is no view anywhere in the product that quietly spans two of them. The insights dashboard is per workspace. The media library is per workspace. The audit log is per workspace.
An API token is granted specific workspaces too, which is how a client’s front end ends up able to fetch its own content and nothing else from the same installation.
One installation holding three workspaces, each granted a different set of content types.
What is scoped to a workspace
Everything on this list is separate per workspace, without configuration.
- Entries, of every content type
- Which content types exist at all
- The media library and its folders
- Members, and who may reach it
- The insights dashboard and every panel on it
- The audit log
- API token grants
- Assistant conversations
Three things that surprise people
- There is no workspace owner
- Membership is a plain link. Any member holding
workspaces:updatecan add or remove any other member, including themselves. There is no per-workspace role and no owner who outranks the others. - The last member cannot be removed
- Because access is scoped to membership, a workspace with nobody in it is unreachable rather than merely unowned. The attempt is refused rather than quietly stranding the content.
- Archiving is not deleting
- A workspace can be archived and brought back. Deleting one is a separate, deliberate act: it clears the memberships, the assets and the token grants, and a workspace that still holds records refuses to be deleted until somebody removes them on purpose.
- Switching is a header, not a session
- The workspace travels as a header on each request rather than as server-side state, so two tabs on two clients do not fight each other.
Questions agencies ask
How many workspaces can I have?
Three on Community, and unlimited on a plan — it is one of the four caps a plan lifts. There is no per-workspace price above that: the eleventh costs what the fourth did. What bounds it after that is your database and your patience for the switcher.
Can a client sign in and see only their workspace?
Yes — add them to that workspace and no others. They will not see the rest exist. Their role still applies globally, so a client contributor is a contributor in their own workspace and a member of nothing else.
Can I share one media library across brands?
No. Media is workspace-scoped like everything else. Reusing an asset across two workspaces means uploading it twice, which is a real cost of the isolation.
Is one workspace per environment a good idea?
No. Workspaces separate audiences, not stages. Staging and production want separate databases, because a workspace shares the schema and the deploy with every other one.
Next
Every feature is included, free
The core is MIT licensed and every feature is in it — none of them is paid-only. Community runs free in production; a plan buys room and governance, not a different product.