Workspaces and modules
Workspaces and modules
A workspace is one organisation's own space on a deployment: its people, its data and its settings. A module is one part of the product, such as Tasks, Costs or Domains, that plugs into the core and can be there or not.
Deployments and workspaces
One deployment, reached at an address such as https://<your-deployment>, can hold several workspaces. The code calls a workspace a tenant; the screens say "workspace" or "organisation". Every record in MaxSuite belongs to exactly one workspace.
- You belong to one workspace, and you sign in to it.
- Nothing you do can reach another workspace's data. This is enforced in three separate layers underneath the app, so one mistake on its own does not leak another workspace's rows.
- Being an administrator makes you an administrator of your own workspace only. It never shows you another organisation's data.
A deployment can hold three kinds of workspace:
| Kind | What it is |
|---|---|
| Home | The organisation that runs the deployment. Its administrators are the platform administrators. |
| Client | An organisation the operator runs a workspace for. Its own administrators cannot change which modules it has, or open sign-up. |
| Standard | A workspace made before client workspaces existed. It behaves like an ordinary workspace. |
Some acts change the whole deployment rather than one workspace: switching modules on and off, uploading themes, choosing where files are stored. Only a platform administrator can do those, whatever permissions anyone else holds.
Do not confuse workspaces with the Workspaces module in Work. That module prepares folders on a device where an agent can read files and run commands. See Workspaces.
Modules
The core knows who you are, which workspace you are in, what you may do and how to reach you. It does not know what a task or an invoice is. Each module brings its own:
- screens and sidebar entry;
- permissions, named after the module, such as
costs:read; - scheduled jobs;
- agent tools, named after the module, such as
costs.list; - tables, which belong to it alone.
The core never reaches into a module. Modules register what they offer, and the core lists it. That is why a module can be absent without leaving a hole: its sidebar entry, routes and tools simply are not there.
Three things a module needs before you see it
| Decided by | Meaning | |
|---|---|---|
| Installed | Whoever runs the deployment | The module's code is part of this deployment at all. |
| Entitled | Someone with entitlements:manage, never from inside a client workspace | Your workspace may use it, like having bought it. |
| Enabled | A platform administrator with modules:manage | It is switched on for the whole deployment. Its scheduled jobs run only while it is on. |
A module passes all three, and then you also need the permission its sidebar entry asks for. Modules, at the foot of the sidebar, shows each module's three states and whether it is in your sidebar. See Modules.
Products
Some modules are offered together as a product. MaxOps, for example, groups monitoring, services, domains, DNS, integrations, devices, MaxVPN and the infrastructure map. A product is only a grouping. Granting a product grants every module in it and what those modules depend on. It owns no data and no permissions of its own.
Dependencies
Some modules need others. Comms needs Agents, for example. Granting a module grants what it depends on too. Revoking one is refused while a module that depends on it is still granted. The Modules screen shows each module's Depends on and Needed by.
Switching a module off keeps its data
Disabling or revoking a module hides it: the sidebar entry goes, its routes answer as if they did not exist, and its tools vanish. Disabling also stops its scheduled jobs, for the whole deployment. Its tables and rows stay exactly where they were. Turn it back on and everything is there again.
Capabilities
Some things are offered by one module and used by others. The plainest is a language model: several modules write with AI, but none of them provides a model. The AI module does, once a connection is added. The Modules screen lists these under Capabilities on offer, for example llm.chat ← ai.
What to watch for
- A missing sidebar entry is not a fault. The module is not installed, not entitled, not enabled, or you lack its permission. The Modules screen tells you which.
- Some modules hide nothing but show less. A module can be on while a person or key still sees no rows, because rows are narrowed to the people they belong to. See Sharing and visibility.
Related
- Concepts
- Modules: the screen that shows all of this
- People, roles and permissions
- Sharing and visibility
- Introduction