The workspace model

Lokrix is multi-tenant by design. Everything you track lives inside a three-level hierarchy — Organization → Workspace → Project (a Project is a Property) — with role-based access control at each level and strict tenant isolation so no data ever crosses between organizations.

The Lokrix AI workspace hierarchyA tree: one Organization contains a Workspace, which contains three Properties (each a website), and one property expands into three Scans.OrganizationWorkspaceRBAC rolesPropertyacme.comPropertyacme.ioPropertyacme.euScanScanScan

The hierarchy

  • Organization — the top-level tenant, usually your company. It owns billing, the credit balance and enterprise settings such as SSO.
  • Workspace — a team or environment inside the organization. Members, roles and shared data are scoped here; a workspace groups the properties a team works on.
  • Project / Property — one site you track. A property holds its own prompt universe, scans, scores, history and recommendations. In the app, “property” and “project” refer to the same thing.

Tracking many properties

A single workspace can track many properties at once — for an agency, each client site; for a brand, each product or regional site. The active property is chosen with the property switcher, and everything you see (scans, scores, recommendations) is scoped to it. Entering a URL in onboarding creates a new property, then analyses it, generates its prompts and runs its first scan.

See Managing properties, the property switcher and Onboarding a property.

Roles and access

Access is governed by role-based access control (RBAC) with four roles:

  • Owner — full control, including billing, members and deletion.
  • Admin — manages members, properties and settings, but not ownership transfer.
  • Editor — creates and edits properties, prompts and scans.
  • Viewer — read-only access to scores, history and reports.

Enterprise plans add SSO/SAML and SCIM provisioning at the organization level. For programmatic access, issue scoped API keys instead of sharing seats — see API keys and scopes.

Tenant isolation

Every query is tenant-scoped: data belonging to one organization or workspace is never visible to another. Credits, meanwhile, are pooled at the organization and metered as live engine runs consume them — see Credits. New here? Continue with the Quickstart.