Access Scope
Access Scope is the set of permissions that says what a person, guest or service can see and do in one Workspace.
type: platform-surface · status: draft · abstraction: entity
What it is
An Access Scope says what a person, guest or service can see and do in one Workspace. Think of it as their Workspace access profile.
A signed-in Identity has a separate Access Scope for each Workspace it can use. A guest receives a restricted Access Scope through a signed invitation and does not need an Identity.
IMOS must find one valid Access Scope before handling a request in a Workspace. If none exists, there is no access. Removing an Access Scope ends access to that Workspace only; it does not remove the Identity or affect access to other Workspaces.
Why it exists
A person or service may work with several organisations but need different permissions in each Workspace. Storing those permissions on the global Identity could carry access into the wrong Workspace and make access difficult to remove for only one organisation.
Access Scope keeps identity separate from Workspace access. Each Workspace can independently decide who may enter, what they may do, what they may see and when that access ends.
Relationships
This page has no relationships in the graph. It appears in the orphan report (registry/accepted-orphans.yaml).
Stakeholder summaries
- Product — Treat Access Scope as a Workspace access profile: assign permissions directly or through Roles and Teams, then remove access independently for each Workspace.
- Investor — Workspace-specific access keeps global identity separate from tenant permissions and supports secure work across organisations.
- Marketing — Give each person, guest or service separate access in each Workspace without affecting their access elsewhere.
- Engineering — Resolve exactly one valid Access Scope for each Workspace request, then check its grants, visibility and Access Channel limits.