SaaS workspace

Sides

A tenant's members, guests and agents

Unit of work

The tenant's own records

Examples

• BI sold to a tenant

The five tests

1. who signs in
2. which record dominates
3. who acts next
4. how money moves
5. who may settle what

Carried only by it, from What every App needs

Views as runtime data; local-first sync; tenant schema; the sharing graph; operated tenancy

Screens its Interfaces name, by reader

Member

My work · inbox · triage per team · list, board, calendar, timeline and table of one Noun · saved Views, personal and shared · the record page with fields, the next allowed transitions, relations, activity, attachments, subscribers, the assignee and delegate, agent sessions · comments · projects and cycles · documents · search and a command palette · quick-add with templates · history with undo

Admin, owner

Members and seats, human and agent apart · teams · schema and custom fields · access by role, Verb, rows and fields · workflow editor · automations · integrations · agents with scopes, guidance, Limits and cost · import · export · security · audit log · billing and usage · a page builder for a narrower role

Guest, requester

A guest shell showing only what is shared · a request form · a share-link view with expiry

Vendor operator

Tenants list with aggregate health · an impersonation session with a reason, a time limit and an entry the tenant sees

Tenant analyst

The tenant's own Metrics, saved queries, Dashboards and scheduled Reports, with the same honest-reading rules as every other type

Tenant, over outside records

Connections to accounts the tenant does not own, read-only, with consent, history depth and provenance per value

Build today: the Site pages around it

• api-product Template
• pricing
• Vanroster

11actors7workflows10records

A SaaS workspace is the App where one tenant Business's people and agents keep their own records and move them through their own work. The record is an issue, a patient chart, a reservation, a matter or a design file.

Both ends of the sale are Businesses. The seller makes the Product, and the buyer, usually not a Startup, rents it to run part of itself.

The job has four parts at once. Record the truth with history, move it through an opinionated lifecycle, and collaborate on it. Let the tenant compose its own views, fields, rules and agents.

A workspace is the buying Business's business-as-code, rented. Three instances widen it. BI sold to a tenant is a workspace whose records are the tenant's Metrics and Reports. A department sold as a Service is a workspace the vendor operates for the tenant under a visible mandate. A consolidation App is a workspace over records the tenant reads but does not own.

A partner-sharing console for a data product is not this type; it belongs to the developer portal. The study describes the work; how an App is defined is open, see What every App needs.

Tenant6 actors

• Tenant ownerWorkBilling, security, deletion and transfer; often the steward of schema and access
• Admin, team leadWorkMembers, teams, each team's workflow and triage, integrations, settings
• Member, viewerWorkA seat that creates and moves records; a cheaper read-only seat
• Assignee and delegateWorkThe assignee stays accountable; the delegate, often an agent, does the work
• Identity admin, billing contact, integratorWorkSSO and SCIM; invoices and plan; keys and webhooks
• Tenant agentsWorkDelegates on a record, a personal assistant with its person's rights, scheduled agents, installed third-party agents

Outside the buyer1 actor

• GuestWorkSees only the teams or records shared with them

Inside the buyer1 actor

• Requester without a seatWorkFiles work that lands in triage and follows its status

The selling Business2 actors

• Vendor support, safety, financeWorkSee aggregates by default, never rows
• Vendor operator under a mandateoperating the tenant's SystemWorkActs every day under a standing grant the tenant sees and can revoke

Vertical variants1 actor

• The tenant's own clientsWorkRead their own slice through a portal, email or a share link

1. 01
   Workflow 1: Signup to first value

   1. 1.1Arrive from the Site, an invite or an agent's Mandate; a matching email domain offers to join the existing tenant.
   2. 1.2Provision the Tenant with a trial and the owner.
   3. 1.3Seed statuses, record types and removable demo data from an industry template.
   4. 1.4Import from the incumbent, which in a vertical is often the true first value.
   5. 1.5Invite people.
   6. 1.6Move one record through its lifecycle with two people and one agent.
2. 02
   Workflow 2: The core loopMember, viewer

   1. 2.1Intake from a member, a form, email, an integration, an agent or the API; outside intake goes to triage.
   2. 2.2Triage rules set team, assignee, labels and priority; a rotating owner or an agent accepts, declines, merges or snoozes.
   3. 2.3The assignee works the record and may delegate to an agent, whose session ends in a reviewable result.
   4. 2.4Restricted transitions need a reviewer or an approval chain by threshold.
3. 03
   Workflow 3: SharingMember, viewerGuest

   1. 3.1Share a record, folder or View with a member, guest, link or partner; containment carries the grant down.
   2. 3.2"Stopping sharing stops future reads.
   3. 3.3It does not un-read data a partner already pulled." That sentence sits on the control.
4. 04
   Workflow 4: Migration

   1. 4.1Map columns and users, match on the source id so re-import updates, preview with problem rows skipped, apply as one change set with undo-all.
   2. 4.2Incumbent exports take weeks, some records never export, and billing history arrives as one opening balance, so the incumbent runs in parallel.
5. 05
   Workflow 5: OffboardingMember, viewer

   1. 5.1A member who leaves is suspended at once; their open records, triage duty, agent sessions and integrations are reassigned, and their history stays attributed.
   2. 5.2A tenant that leaves exports everything, then a deletion window runs.
6. 06
   Workflow 6: Operated tenancy

   1. 6.1A department sold as a Service runs the tenant's System daily.
   2. 6.2Every act names the mandate it runs under, the tenant reads them all, and revoking the mandate stops the next one.
7. 07
   Workflow 7: Consolidation

   1. 7.1A household or a holding company connects accounts it does not own.
   2. 7.2Connections never move money, and each value shows its source and age.

Tenant9 states

1. unclaimed
2. trialing
3. active
4. past due
5. read-only
6. suspended
7. closing (restorable)
8. deleted
9. held under a legal hold

Membership (a person in a Role in a Tenant)4 states

1. invited
2. active
3. suspended (history kept)
4. removed

Work record, issue-style11 states

1. triage
2. backlog
3. to do
4. in progress
5. in review
6. done
7. blocked
8. canceled
9. duplicate
10. archived
11. snoozed and delegated as overlays

Work record, vertical6 states

1. the Industry's own: a reservation runs inquiry
2. held
3. confirmed
4. checked in
5. checked out
6. folio closed

Agent session6 states

1. pending
2. active
3. awaiting input
4. complete
5. error
6. stale

Change set (bulk, import or agent write)4 states

1. proposed
2. in review
3. applied or discarded
4. undone

Share3 states

1. active
2. expired or stopped
3. kept as evidence

Operating mandate4 states

1. granted by the tenant with scope by System
2. Verb and threshold
3. active
4. revoked

Connection to outside records6 states

1. consented
2. syncing
3. stale
4. revoked
5. a mirrored record is re-read
6. never edited

Notification4 states

1. unread
2. read
3. deleted
4. snoozed back to unread. Distinct from a Task

ActorsCopy Anchor Link

Accountability is human; action may be an agent's. The tenant governs its own people and agents, the vendor governs the platform, and neither sees the other's private side by default.

InterfacesCopy Anchor Link

A second role gets a second App over the same records, not a version of the first with fields hidden. A designer and a developer read one design file through two modes.

Records and actionsCopy Anchor Link

Verbs group by job. Tenancy: provision, invite, request setup, export, transfer, suspend, close, restore. Records: create, update, the lifecycle's named Verbs, archive, merge, move.

Triage: accept, decline, mark duplicate, snooze, request information. Collaboration: comment, mention, subscribe, remind. Delegation: delegate to an agent while the assignee stays, answer its question.

Sharing: share, stop sharing, request access. Import: map, match, preview, apply, undo.

TermsCopy Anchor Link

Terms4 quoted from startupbuilder.dev · 4 it lacks · 2 colliding

Term	In startupbuilder.dev	Definition, quoted from startupbuilder.dev or the gap
Tenant	Tenant	"A Tenant is the partition of a Startup's data that belongs to one Customer." startupbuilder.dev avoids "Workspace", the market's word in this type's name. Read for any Business.
Role	Role	"A Role is a seat that owns a set of work and holds the Permissions to do it, filled by a Human or an Agent." A seat and an agent seat are one mechanism.
Task	Task	"A Task is an Action waiting on a Worker, with an assignee, a due time, and a place in that Worker's inbox."
Notification	lacks	An Event the reader follows that needs no action. startupbuilder.dev avoids "notification" as a Message synonym.
Guest, mention, presence, custom field, import job	lack
Watcher of one record	collides	Subscription is billing; startupbuilder.dev's Watch is an outbound webhook.
Team, Template, Interface	collide	startupbuilder.dev's Team is a Startup's Workers; Template is a Product or Startup Template; Interface is how a party reaches a Product, not a page set for a role.
View presentation	lacks	startupbuilder.dev's dynamic Collection covers the saved query, not its layout.
Reports	Reports	"Reports arranges saved Metric queries into Dashboards, weekly reviews and investor updates, delivered on a schedule and watched for thresholds." Sold to a tenant, it is this type.
Operating mandate, connection	lack	A Mandate is an Agent's; a vendor operating a tenant's System needs its own grant.

WorkflowsCopy Anchor Link

1. Signup to first value. Arrive from the Site, an invite or an agent's Mandate; a matching email domain offers to join the existing tenant. Provision the Tenant with a trial and the owner. Seed statuses, record types and removable demo data from an industry template. Import from the incumbent, which in a vertical is often the true first value. Invite people. Move one record through its lifecycle with two people and one agent.
2. The core loop. Intake from a member, a form, email, an integration, an agent or the API; outside intake goes to triage. Triage rules set team, assignee, labels and priority; a rotating owner or an agent accepts, declines, merges or snoozes. The assignee works the record and may delegate to an agent, whose session ends in a reviewable result. Restricted transitions need a reviewer or an approval chain by threshold.
3. Sharing. Share a record, folder or View with a member, guest, link or partner; containment carries the grant down. "Stopping sharing stops future reads. It does not un-read data a partner already pulled." That sentence sits on the control.
4. Migration. Map columns and users, match on the source id so re-import updates, preview with problem rows skipped, apply as one change set with undo-all. Incumbent exports take weeks, some records never export, and billing history arrives as one opening balance, so the incumbent runs in parallel.
5. Offboarding. A member who leaves is suspended at once; their open records, triage duty, agent sessions and integrations are reassigned, and their history stays attributed. A tenant that leaves exports everything, then a deletion window runs.
6. Operated tenancy. A department sold as a Service runs the tenant's System daily. Every act names the mandate it runs under, the tenant reads them all, and revoking the mandate stops the next one.
7. Consolidation. A household or a holding company connects accounts it does not own. Connections never move money, and each value shows its source and age.

Money: a per-seat Subscription where seat counting is policy (guests, viewers, agents, suspended users). Dunning runs past due, grace, read-only (reads and exports allowed), suspended, closed.

A downgrade turns over-limit data read-only, never deleted. In vertical variants the tenant's own money flows inside the workspace, and that brings refunds, chargebacks and payouts from the marketplace.

BoundariesCopy Anchor Link

• No read or write crosses a Tenant without an explicit share. In a local-first App, data is partitioned per tenant down to the client database.
• Grants flow down containment, and the precedence rule is stated: in one market product the broadest grant wins, which users assume is the opposite.
• Row and field rules are enforced in the data path on every read and write, never as a View filter. That holds for every Interface, MCP and imports included.
• Search, autocomplete, mention pickers, link previews, notification bodies, digests, webhooks, exports, AI answers and error messages all pass the same check.
• The vendor sees aggregates. Rows only through impersonation with a reason, a time limit and a scope, recorded where the tenant sees it. Vendor agents follow the same rule, and vendor AI never trains on tenant content.
• Under an ethical wall or private team, admin does not mean read-all. A tenant admin's view of members carries no last-seen, activity or counts unless the Business's Setting says otherwise.
• "My team's tasks by person" is a per-person view. The tenant declares its measurement policy per deployment, and the workspace enforces it where queries are built.
• Embedded tenant analytics takes the tenant from the authenticated principal, never from a parameter alone.

AgentsCopy Anchor Link

Hard partsCopy Anchor Link

1. Latency and sync. Instant needs a client store, optimistic writes, a durable queue, delta catch-up and rollback. Permission is decided before data reaches the client, so revoking access purges the client cache.
2. The inbox is three things. Notifications, Tasks waiting on me, and triage for my team. Merged, they bury the Tasks; split wrongly, they make three badges.
3. Opinion against configuration. Defaults are opinions; escape hatches are narrow. Every escape hatch multiplies the test and migration matrix.
4. Views are data. Authored at runtime by people and agents, personal or shared, they survive schema changes and grant no access.
5. Schema at two levels. The vendor ships Versions; the tenant adds fields, options and statuses. A vendor upgrade merges with tenant extensions without breaking their Views, rules or imports.
6. Who counts as a seat. If agents do the work, per-seat revenue erodes, and startupbuilder.dev counts an agent filling a Role as a seat.
7. Two audits pulling apart. Compliance needs an immutable log bound to identity; workers need protection from per-person surveillance. The boundary is query direction, not the field set.
8. Regulated records. Health, legal and finance verticals bring their own rules and clocks. A vertical template that does not know its Industry's rules is not a system of record.

Day oneCopy Anchor Link

The test: one tenant Business replaces its spreadsheet or incumbent for one Process this week, and its agent does the same through MCP. That needs:

• one dominant Noun with typed lifecycle states and required fields per state;
• tenancy and per-seat billing, with a trial and one-step cancel with export;
• list, board, the record page with comments, My work, one inbox, email and saved Views;
• attributed writes with undo, and soft delete;
• CSV import, and API, MCP and webhooks;
• one labelled agent whose bulk writes become Approvals;
• the vendor boundary from the first day, cheap first and costly to retrofit.

The Startup layer adds stage and operating model. At idea stage the App may be a waitlist plus the API and MCP.

In the Autonomous model the vendor's support and billing are agent Roles, so the impersonation rule binds agents first. Product-led growth makes invites and shares acquisition.

Related studiesCopy Anchor Link

Prototypes this study needsCopy Anchor Link

1. 01

   Can the founder's stream cross tenants safely?

   Two Startups and three provider Businesses as a union of per-tenant reads that never join records.

   names: tenant
2. 02

   Can a Role filling carry an agent's seat?

   One hired agent in two tenants, checking that no Memory crosses, then let go.

   names: tenant
3. 03

   Do tenant Views survive a vendor rename?

   A vendor v1, a tenant field, View and saved Metric query, then a v2 that renames the field.

   names: tenant