Hierarchy, regions and isolation
Lainstack has three levels, and each one holds the next. This page is for the person setting up Lainstack and for anyone reviewing how it separates data. It explains what each level is for, where a region fits, how to invite people at each level and what stays apart. For day-to-day setup, see Organizations and workspaces.
The hierarchy
Section titled “The hierarchy”| Level | Use it for | Belongs to |
|---|---|---|
| Super organization | Oversight of several organizations, single sign-on and domains | Nothing above it |
| Organization | One company, business unit or client, in one region | One super organization |
| Workspace | One team or area of work, with its own automations and data | One organization |
A workspace cannot move to another organization. Creating an organization also creates its super organization and a first workspace, so a new account starts with one of each.
Regions
Section titled “Regions”A region is where an organization’s work is stored and run.
- An organization lives in one region, and so do its workspaces. There is no region choice per workspace, and there is no setting to move an organization to another region.
- A region is not a level of the hierarchy. It is a property of each organization, not a container for it.
- Automations, runs, escalations, connections, reference tables and files stay in the organization’s region.
- Accounts are shared across regions. Sign-in, people’s names and email addresses, memberships, single sign-on settings and the list of organizations are held centrally, and each region keeps a read-only copy.
- Your automations decide what leaves. A block that calls another system or a model provider sends data to wherever that system is, whatever the organization’s region.
A person has one account, so they can belong to organizations in different regions and sign in once. If you need work kept in a particular region, keep it in an organization in that region.
Invite people
Section titled “Invite people”People join by invitation only, at every level. Nobody is added to anything until they accept, even if they already have an account. Invite from Members at the level you want.
| Level | Who can invite | Invite by | What accepting gives |
|---|---|---|---|
| Super organization | Operations director | Email address | A role on the super organization, and no seat in its organizations |
| Organization | Organization admin | Email address | A role in the organization, and any workspaces chosen on the invite |
| Workspace | Workspace lead or Organization admin | A current organization member, or an email | A role in the workspace, and the organization too if they are new |
Every invitation has a Role and can have an Access expires on date, after which the access is removed automatically. An invitation link is valid for 7 days. The Invited tab lists pending invitations, with Resend, Revoke and Copy link.
Super organization
Section titled “Super organization”Invite people who oversee the whole account. This invitation cannot include organizations or workspaces. If the person also needs to work inside an organization, invite them to that organization as well. See Who can see across the levels.
Organization
Section titled “Organization”Choose a role. Organization member is the smallest one: the person belongs to the organization and sees only the workspaces they are a member of.
You can also tick Workspaces (optional) and pick a role in each. Accepting adds the person to those workspaces, and you must be able to manage members in every workspace you pick.
Workspace
Section titled “Workspace”Type a name to find a current organization member, or type an email address.
- A current organization member gets a workspace invitation to accept. It waits for them under Personal, in Invitations.
- Someone new gets one organization invitation that carries this workspace, as an Organization member. Only someone who can also manage the organization’s members can invite a new person. A Workspace lead without that permission can invite current members only.
What stays apart
Section titled “What stays apart”Between workspaces
Section titled “Between workspaces”Each workspace has its own automations, connections, reference tables, operations, runs, escalations and agents. A workspace member sees only the workspaces they belong to, and a role in one workspace means nothing in another. A person who leads one workspace and views another can change only the first.
Workspaces do not share their work. A connection belongs to one workspace, and Run automation can call only automations in the same workspace. A client connected through MCP gets a token limited to the workspaces you approve.
Between organizations
Section titled “Between organizations”Members, teams, roles and OAuth clients belong to one organization. A person who belongs to two organizations has a separate role in each, and a role in one gives no access in the other.
Between regions
Section titled “Between regions”Work in one region is stored and run in that region. See Regions for what is shared.
Who can see across the levels
Section titled “Who can see across the levels”Being higher up does not by itself open the work below. It depends on the role, and on having a seat at the right level.
| Seat | Reaches |
|---|---|
| Organization admin | Automations in every workspace of that organization: read, change, run, publish and manage them |
| Organization viewer, External auditor | Read automations in every workspace of that organization |
| Organization member | Only the workspaces they are a member of |
| A super organization role with no organization seat | At most the super organization’s settings and its list of organizations and workspaces, not the work inside them |
| A super organization role with an organization seat | Work in that organization, as allowed by the roles held |
Roles and what they allow are managed in the organization settings under Access & Roles. To see who has access, check Members at each level, including the super organization.
How the separation works
Section titled “How the separation works”Isolation is logical. Organizations in a region run on shared services and databases, not on separate infrastructure per organization.
- Every record belongs to a scope. Records carry the organization or workspace they belong to, and reads are limited to it.
- Access is checked on the server for each request. Lainstack decides from who you are and the roles you hold in that scope, never from what the browser or a client claims.
- Roles apply only where they were granted. A role held in one workspace or organization is not applied to another.
- Connection secrets are encrypted by the application before they are stored.
- Access changes are recorded, along with single sign-on changes, connection changes and review decisions.