Workspace

What It Models

The workspace is an association’s operating environment under one customer. The Workspaces service owns its record and the durable records for provisioning, reset and retirement. Business status expresses the staff decision about use; lifecycle expresses readiness, loading and destruction. They are separate axes with database checks between them.

Identity and Attributes

Provisioning uses a readable identifier selected by staff and subject to the customer identifier grammar. It remains unique and permanent; the deletion ledger prevents later reuse. Migrated associations retain their earlier valid identifier. Workspace-scoped operations address the workspace explicitly.

The attribute rows distinguish stored fields, computed answers and supporting records.

Relationships

Each workspace stores one customer reference, which protects that customer from deletion. A sandbox stores its parent reference; a customer-type parent may have several sandboxes and cannot be retired while they remain. Accounts, assignments and grants store their workspace references. Purge removes the portal memberships and dependent security records for that workspace.

Invariants

The structured invariant rows identify each protection, its enforcement layer and its evidence. Read their qualifications with the statement rather than treating a service check as a database constraint.

How It Is Stored and Shared

The attribute and relationship rows define the record and its associated work. Sender identity belongs to Notifications. The external deletion ledger is object storage rather than a database table; it retains completed-deletion evidence and prevents identifier reuse after a restore.

Open Design Questions

Access services enforce the availability invariant. HQ staff retain the documented inspection routes, including during loading, while ordinary customer access follows lifecycle and business status. Loading activation does not record a missing first-activation time; policy depending on that timestamp needs a product decision.

Custom fields have no enabling declaration and are excluded by the product classification. Ownership of participant execution remains a planning question: this service records staff intent and the workspace lifecycle, while participant services execute their own work. Import completion proof, loading retirement and restored-deletion recovery remain open findings.