# Initiative Brief: Workspace & Managed-Context Authorization True-Up ## Desired outcome Bring Xyence Workspace authorization, Doorway authorization, and Console access-management UI into alignment with the authorization architecture that already exists in Outshine. The primary goal is to make Workspace access fully manageable through first-class UI surfaces while clarifying the architectural distinction between **Workspaces**, **Doorways**, and other authorization scopes. This initiative should **not introduce a new identity system, permission engine, membership store, or authentication architecture**. Outshine remains the canonical source of truth for users, principals, roles, permission grants, and authorization decisions. The implementation should build on the existing `PermissionGrant`, `PermissionRole`, `Principal`, `WorkspaceInstance`, Workspace membership APIs, and `permission_engine.can(...)` machinery. --- ## Rejected / deferred alternatives - Do NOT: - replace the Outshine permission engine, - create a second Workspace permission system, - create a new identity database, - migrate authentication out of Outshine, - build Account Center now, - rewrite `auth.xyence.io`, - turn Workspaces into Doorways, - remove Doorways, - encode Workspace access using Console-local teams, - duplicate permission state in Console, - hard-code the system around Sales, - make `workspace_admin` global, - redesign all authorization scopes in one pass, - undertake unrelated Console navigation or styling refactors. ---