Workspaces, Teams and Roles

Understand tenant isolation, membership and permission-controlled actions.

A CoreFinOps workspace is the customer data boundary. It can include several users and connected AWS accounts; each user sees and edits only what their memberships and effective permissions allow.

Identity and authorization

Authentication uses Cognito in the target architecture. The API resolves the authenticated subject to database-backed membership and permissions on every request. Client-side navigation visibility is a convenience, not an authorization boundary; PostgreSQL FORCE RLS supplies an additional tenant isolation layer.

Typical responsibilities

Organization admins handle tenant administration and membership. Migration leads manage portfolio readiness, waves and transition. FinOps users work with allocation, budgets, recommendations and financial verification. Executives primarily need governed, read-focused views. Exact rights are established by the permission catalog, not the job title.

New organization versus join existing

The commercial expansion includes self-service workspace creation and authorized invitations. A person should not join another company's workspace merely because they have the same email domain. Invitation and administrative approval must be tenant-specific, replay-safe and auditable.

Multiple workspaces

Verify the selected workspace before interpreting a dashboard or taking action. Application, cost, billing and Marketplace agreement identifiers must remain correctly scoped even when the same user belongs to more than one organization.