Organizations & workspaces

PopMCP has two levels of tenancy.

Organization (team)
  └── Workspace (sub-account)
        ├── ProviderConnection   one encrypted credential per provider
        └── McpInstance          one hosted MCP surface per connection

Organization

The top-level tenant, meaning your team. Billing, membership, invitations and the IP allowlist all live here.

How an organization gets claimed:

• The first person signing in from a corporate domain creates that domain's organization and becomes its OWNER.
• Anyone else on the same domain who signs in without an invitation lands on /join and waits for an owner or admin to send them an invite link.
• A public email domain such as Gmail or Outlook gets its own personal organization per user, because a shared domain would otherwise put strangers in one team.

Workspace

A workspace sits inside an organization. It is provider-agnostic and holds at most one connection per provider.

That constraint has a practical consequence. Connecting a second Klaviyo account means creating a second workspace. Teams typically run one workspace per client, brand, or region.

Only an owner can create or delete a workspace. Owners and admins can rename one and manage who is in it.