Resource scope

Operade resources are scoped to a Workspace. The Workspace identifier in a path is part of the authorization boundary, not only a routing convenience.

Workspace-bound credentials#

Every API key belongs to one Workspace. When an API-key operation accepts a path such as /workspaces/{workspace_id}/..., the path identifier must match the key's Workspace. A mismatch returns HTTP 404, not HTTP 403, so a caller cannot use the response to discover another tenant's resources.

That tenant boundary is not a least-privilege filter inside the Workspace. For routes that allow API keys, the key currently receives workspace-admin authorization and can access every resource exposed by that operation, including resources private to another member. Operade does not currently offer per-key roles or per-resource allowlists; restrict issuance and review each allowed operation accordingly.

Browser sessions first establish a user identity, then the route checks membership and the required owner, admin, or member role in the path Workspace. Resource identifiers are also queried inside that tenant context. An identifier from another Workspace therefore appears not found.

Nested resources#

Agents, Branches, Versions, Deployments, Conversations, Knowledge, Tools, channels, and workspace settings remain attached to their Workspace. A nested path does not authorize moving or reading a resource merely because its identifier is known. Use identifiers returned from the same Workspace and avoid caching them without their Workspace context.

Tested isolation boundary#

Operade's backend applies tenant-scoped access and tested PostgreSQL row-level security to tenant tables. These controls are defense in depth around the route checks. This statement describes tested product behavior; it is not a compliance certification, audit report, or service-level guarantee.

Diagnosing scope failures#

First confirm the key's Workspace and the path Workspace. Then verify the operation allows API keys and the resource was created in that Workspace. Treat HTTP 404 as either absent or out of scope; do not probe adjacent identifiers. For a session, verify current membership and role.

If a resource created in the same Workspace still appears missing, record the safe resource identifier, operation, UTC time, and credential type, then follow Support. Never send the credential value.

See Authentication, Workspace permissions, and API errors.