Concepts

Platform system_admin may view any organization for support. They cannot mutate org settings without org admin membership — there is no silent bypass in the UI.

Organization as security boundary

Authentication happens at the platform (your Account).
Authorization for org settings uses your org role (owner, admin, member, …).
Product data lives in workspaces; org settings do not replace workspace membership.

Roles {#roles}

Org role	Typical powers
owner	Everything an admin can do plus ownership transfer and delete org
admin	Members, SSO, security, domains, workspaces, plan
member	Use workspaces they belong to; read most org tabs

Org role is separate from workspace role (owner, admin, member, viewer). A user can be org member but workspace admin.

Ownership {#ownership}

Exactly one org owner at a time.
Promote to owner only via Transfer ownership (owner confirms org name).
Transfer cascades: the new org owner becomes sole owner on every workspace; the previous owner becomes admin on those workspaces.
You cannot assign owner through Members invite or PATCH — use transfer.

Personal organizations {#personal-organizations}

Some accounts have a personal organization:

Cannot invite additional org members
Cannot create additional organizations (guest rules apply)
Workspace and product use still work normally

Team features (invites, SSO at org scale) require a standard organization.

SSO and join requests

When SSO is enabled:

Users sign in with work email; Spanline routes them to the org’s IdP.
Auto-approve settings can admit members immediately or filter by department (Lark).
Otherwise join requests appear under Members → Pending approval for admins.

Workspaces in an org

Workspaces belong to exactly one organization.
Org Workspaces tab lists and creates them (subject to plan quota).
Each workspace has its own member list — see Workspaces concepts.

Plan, license, audit

Surface	Purpose
Plan	Seats, feature flags, quotas (workspaces, members, …)
License	Seat license attachment when your deployment uses licensing
Audit	Immutable org-scoped event log; export CSV for compliance