Skip to main content
A workspace is the organizational context in which capabilities are owned, operated, and shared. It contains people, agents, capabilities, deployments, runs, tickets, evidence, discussions, permissions, integrations, credentials, and shared knowledge. Workspaces provide organizational boundaries, access control, collaboration, discoverability, shared ownership, and operational context. Capabilities should be visible within the appropriate boundary so good work can spread without losing governance.

​
The hierarchy

There are three workspace types.

​
Roles

Membership is per workspace, and each member holds one role. Org-level administration — auditing credentials across every workspace in the org, or changing a credential’s scope — requires owner or admin at the org.

​
Access mode

Each workspace has an access mode that controls who can join. Set it with jstm workspace update <workspace> --access-mode RESTRICTED.

​
Agent visibility

Separately from workspace membership, each agent carries a visibility that controls who can find it. ORG_VISIBLE is what makes a good capability spread. Another team finds it with jstm agent search, installs it into their own workspace, and runs it with their own credentials — while the original stays owned where it was built.

​
Addressing

Almost every identifier accepts three forms: a friendly handle, a UUID, or a fully qualified name like acme-corp/finance/month-end-close. Handles can repeat across organizations, so jstm workspace resolve <handle> returns every match when a name is ambiguous. See Addressing for the full rules.

​
Vaults follow the hierarchy

Credentials live in personal, workspace, and org vaults, and resolve from the most specific outward. See Credentials and vaults.

​
Next

Set up your organization

Create an org, add team workspaces, switch context.

Invite and manage members

Roles, invitations, and removal.