> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspaces & Team Management

> Manage tenant organizations, project isolation, IAM roles, and member invitations.

# Workspaces & Team Management

Qumo Deploy features a hierarchical multi-tenant structure designed for organizations, developer teams, and automated machine principals.

```mermaid theme={null}
graph TD
  User["Authenticated User (OIDC / GitHub / Email)"]
  User --> TenantA["Tenant Workspace A (e.g. Acme Corp)"]
  User --> TenantB["Tenant Workspace B (e.g. Staging Labs)"]

  TenantA --> Project1["Project: live-stream-prod"]
  TenantA --> Project2["Project: test-stream-local"]

  Project1 --> Bot1["Bot: github-actions"]
  Project1 --> Key1["API Key: qumo_live_..."]
```

***

## Workspace Lifecycle

### Self-Service Creation

New users automatically receive an initial personal workspace upon first sign-in. To create additional organization workspaces:

1. Click on the workspace dropdown in the top-left navigation bar.
2. Select **+ Create Workspace**.
3. Provide an organization name and optional billing email.
4. The creating user is automatically assigned the `roles/tenant.admin` role for that workspace.

<Note>
  Each user account can create up to 3 self-service workspaces. For enterprise deployments requiring dedicated fleet quotas, contact your platform administrator.
</Note>

***

## Projects & Environment Isolation

Every resource (API keys, bots, credentials, and telemetry) belongs to a **Project** within your tenant workspace.

* **Production Projects**: Connect directly to the global distributed relay network for live broadcast ingestion and multi-region viewer fanout.
* **Test Projects**: Designated for local Docker testing (`docker-compose.free-tier.yml`) and isolated sandbox workflows. Each workspace is allotted one active local test project on the Free tier.

### Switching Projects

Use the **Project Switcher** in the top navigation header to toggle between environments. All console metrics, keys, and Stream Studio tools update dynamically to reflect the selected project context.

***

## Inviting Team Members & RBAC

Tenant administrators can invite colleagues to collaborate on edge streaming workloads.

### Inviting a New User

1. Navigate to **Organization Settings $\rightarrow$ Members** (`/org/members`).
2. Click **Invite Member**.
3. Enter the invitee's corporate email address and select an initial IAM Role:

| IAM Role           | Identifier             | Scope & Capabilities                                                                        |
| :----------------- | :--------------------- | :------------------------------------------------------------------------------------------ |
| **Tenant Admin**   | `roles/tenant.admin`   | Full control over organization settings, billing, member invites, and all child projects.   |
| **Project Admin**  | `roles/project.admin`  | Manage API keys, provision bots, and update project settings within authorized projects.    |
| **Project Editor** | `roles/project.editor` | Mint relay credentials and initiate Stream Studio sessions. Cannot delete keys or projects. |
| **Project Viewer** | `roles/project.viewer` | Read-only access to usage dashboards, active projects, and audit activity.                  |

4. Copy the generated invitation link or let Qumo dispatch an email notification. The invitation expires automatically after 7 days.

***

## Machine Identities (Bots)

Headless automation systems and CI/CD pipelines should **never** share human user accounts. Instead, provision project-scoped **Bots**:

1. Navigate to **Access Control $\rightarrow$ Bots** (`/permissions?tab=bots`).
2. Click **Create Bot** and specify a descriptive name (e.g. `github-actions-deployer`).
3. Click **Generate Key** to generate a secret bearer token.
4. Bind granular IAM roles (e.g. `roles/project.admin`) to the bot principal (`bot:<id>`).