Workspaces: the foundation for working together
Every account now has a workspace with a real role model — Owner, Admin, Member and Viewer — enforced in the database rather than the interface.
Why now, before collaboration ships
Retrofitting multi-tenancy onto a single-user product is one of the most expensive migrations a SaaS can attempt. So we did the schema first: workspaces, members and roles landed before any invitation flow exists.
Every account already has a personal workspace, created automatically. Your projects, ideas, plans and reports live inside it. Nothing about your day-to-day changed — which is exactly the outcome we wanted.
The database is the enforcement point
Roles are enforced by PostgreSQL row-level security through membership helpers, not by hiding buttons. The interface mirrors those same rules so you are not offered actions you cannot take, but if the two ever disagree, the database wins.
That distinction matters. UI-level permissions are a usability feature; database-level permissions are a security boundary. We wanted the boundary in place before anyone else could join a workspace.