# Workspaces, projects and teams

Dromad is organized the way the work is:

**Workspace → Project → Work.** A workspace is who you are working with. A project is what you are working on. The work is everything Dromad makes: runs, fanouts, question sets, audits and citation analyses.

## Workspaces

Every account has a personal workspace, and work in it is private to you. To work with other people, create a team workspace at [Workspaces › New](https://dromad.dev/workspaces/new) and invite them.

A workspace owns its members, its prepaid credit and ledger, its API keys, its projects, and all the work in those projects. **Being a member is the only permission there is.** Everyone in a workspace sees every project and all of its work, including what teammates ran. There are no private projects inside a shared workspace and no per-run permissions: if something should be private, make it in your own workspace. Work never moves between workspaces.

| | Members | Admins |
|---|---|---|
| See every project and all the work | yes | yes |
| Start projects, run things | yes | yes |
| Spend the workspace's credit, and buy more | yes | yes |
| Make their own API keys for the workspace | yes | yes |
| Share a result by link, or stop sharing it | yes | yes |
| Rename the workspace | | yes |
| Invite people, remove them, change roles | | yes |

A workspace always has at least one admin. Anyone can leave; an admin removes anyone. Removing someone revokes their API keys for that workspace at once. What they made stays, because it is the workspace's.

## Invitations

An admin enters an address and a role at [Workspace › Members](https://dromad.dev/workspace/members) and gets a link. Dromad emails the link when the server can send mail, and always shows it so that you can send it yourself. It works once, expires after 14 days, and can be revoked.

The link is what admits someone, not the address: Dromad does not verify email addresses. Whoever opens the link signs in (or creates an account) and joins, and the members page shows which account accepted each invitation, so an admin can see if it was not who they meant. Treat an invitation link as you would a password until it is used.

Someone who creates their account through an invitation can work in that team's workspace straight away. Their own personal workspace gets its free credit once Dromad has approved the account.

## Projects

A project belongs to one workspace, for good, and everything made is filed under one. There is no catch-all project: a project is what the work is about. It can record that: a primary domain, other domains, brand names and competitors. `dromad status` and the project's page show it, and `dromad citations` uses the domains and names when you give none.

From a terminal, link a directory to a project once and every command run there is filed under it:

```sh
dromad init          # start a project and link this directory
dromad link          # or link to one that exists
dromad status        # where am I?
```

See [Projects and linking](https://dromad.dev/docs/cli#projects-and-linking). The link is kept on your machine, not in the directory, so a repository carries nothing and each teammate links their own clone.

## API keys

A key acts in one workspace and spends that workspace's credit, and it is yours: teammates each make their own at [API keys](https://dromad.dev/account/api-keys), so there is no shared secret to pass around, usage says whose key it was, and revoking yours affects nobody else. `dromad login` is different: it signs *you* in, and reaches every workspace you belong to.

## Credit

Credit belongs to the workspace. A team spends one balance, anyone in it can add to it, and [Billing](https://dromad.dev/account/billing) lists every change with who caused it. The promotional credit a new account gets is for its personal workspace; a team workspace starts at zero. See [Billing](https://dromad.dev/docs/billing).

## Sharing outside the workspace

Membership is for working together. To show one result to someone outside, share it: `dromad share dr_…` gives an unlisted link that opens that one run or analysis, read-only, and nothing else. The page does not say which project or workspace it came from, who ran it, or what it cost. Any member can stop sharing, and admins see every live link on the members page.