> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vegalake.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Organizations and workspaces

> Understand VegaLake tenant boundaries, resource scope, and workspace administration.

# Organizations and workspaces

VegaLake uses two nested boundaries: organizations for administration and workspaces for product resources.

## Organization scope

An organization owns its users, invitations, groups, roles, service principals, two-factor policy, and workspaces. Customer administrators manage these resources under the organization selected in the dashboard. Platform-operator approval and provisioning processes are intentionally outside the public documentation and API reference.

## Workspace scope

A workspace separates data and product resources inside an organization. VegaFlow connections, clusters, and QuickFlows; VegaGraph metadata; and secret vaults all use both an organization ID and workspace ID.

API routes express the boundary explicitly:

```text theme={null}
/orgs/{org_id}/workspaces/{workspace_id}/...
```

Never reuse a workspace ID with a different organization ID. If a resource appears missing, verify both values and the active dashboard selection before assuming it was deleted.

## Manage workspaces

Organization administrators can list, create, inspect, update, and remove workspaces when their permissions allow it. Choose names and descriptions that communicate the environment or team boundary. Before removing a workspace, inventory the connections, clusters, QuickFlows, secrets, and metadata that depend on it.

## Permission layers

VegaLake can grant access at several levels:

* Organization permissions cover administrative collections such as users, roles, and workspaces.
* Workspace permissions control entry to a workspace.
* Product collection permissions control resource families such as connections or entities.
* Instance permissions control a particular connection, cluster, namespace, or graph object.

Use the narrowest scope that supports the task. Continue with [access management](/platform/access-management) for identity and assignment patterns.