Skip to main content

​
Organizations and workspaces

VegaLake uses two nested boundaries: organizations for administration and workspaces for product resources.

​
Organization scope

An organization owns its users, invitations, groups, roles, service principals, two-factor policy, and workspaces. Customer administrators manage these resources under the organization selected in the dashboard. Platform-operator approval and provisioning processes are intentionally outside the public documentation and API reference.

​
Workspace scope

A workspace separates data and product resources inside an organization. VegaFlow connections, clusters, and QuickFlows; VegaGraph metadata; and secret vaults all use both an organization ID and workspace ID. API routes express the boundary explicitly:
Never reuse a workspace ID with a different organization ID. If a resource appears missing, verify both values and the active dashboard selection before assuming it was deleted.

​
Manage workspaces

Organization administrators can list, create, inspect, update, and remove workspaces when their permissions allow it. Choose names and descriptions that communicate the environment or team boundary. Before removing a workspace, inventory the connections, clusters, QuickFlows, secrets, and metadata that depend on it.

​
Permission layers

VegaLake can grant access at several levels:
  • Organization permissions cover administrative collections such as users, roles, and workspaces.
  • Workspace permissions control entry to a workspace.
  • Product collection permissions control resource families such as connections or entities.
  • Instance permissions control a particular connection, cluster, namespace, or graph object.
Use the narrowest scope that supports the task. Continue with access management for identity and assignment patterns.