A workspace is the top-level tenant boundary in TigerTrust. Every certificate, CA, policy, agent, workflow, and audit record belongs to exactly one workspace. Users can hold membership in multiple workspaces and switch between them freely — nothing crosses the workspace boundary implicitly.
Workspaces

​
What lives inside a workspace

All PKI objects

Certificates, CAs, templates, revocation records, CRLs, and deployment jobs.

Machine identity data

Identities, SSH keys, agents, hosts, Kubernetes clusters, and cloud accounts.

Governance

Policies, compliance frameworks, workflows, approvals, and audit logs.

Access and billing

Members, invitations, roles, API keys, subscription, and contract details.

​
Creating and switching workspaces

1

Sign in

You land in your last active workspace. First-time users get an owned workspace automatically during onboarding.
2

Open the workspace switcher

Click your workspace name at the top of the sidebar to open the picker, or go to Workspaces in the navigation to see all workspaces you belong to.
3

Create another workspace

From Workspaces, click New workspace. You are assigned the owner role automatically.
4

Switch workspaces

Select any workspace from the picker. TigerTrust reloads to show only that workspace’s data.

​
Members and invitations

Owners and admins can invite users from Settings > Members > Invite. An invitation email is sent with a sign-in link.
RoleTypical useCapabilities
OwnerWorkspace creator, primary billing contactEverything, including deleting the workspace and managing billing
AdminPlatform or SRE leadManage CAs, agents, policies, and invite users
UserEngineer or operatorIssue, renew, and deploy certificates; view inventory
AccountantFinance or procurementView billing, invoices, and usage
Fine-grained permissions layer on top of roles via RBAC.
Invitations expire after 7 days. You can resend or revoke a pending invitation from Settings > Members.

​
API keys are workspace-scoped

API keys created in a workspace can only access that workspace’s resources. A key from one workspace cannot read or modify another workspace’s data. See API keys for scopes and key types.

​
Billing and plan limits

Subscription status, certificate quotas, and seat counts are enforced per workspace. Owners manage billing from Settings > Billing. Downgrades take effect at the end of the current billing period. The API surface for workspace management is documented at API Reference.

RBAC

Layer fine-grained permissions on top of workspace roles.

Policies

Enforce workspace-wide rules for key sizes, algorithms, and lifetimes.

Agents and Collector

How agents authenticate into a workspace using its API keys.