Workspaces for Enterprise teams

A workspace groups one or more teams under a single Enterprise account. Workspace admins manage membership, billing, and company-wide policies across those teams. Single Sign-On (SSO) is configured at the workspace level.

Workspaces and teams

A workspace provides company-wide administration, while teams organize shared resources and team-level settings.

• Workspace level - Billing, SSO, domain capture, and organization-wide policies apply across teams.
• Team level - Members share Warp Drive resources, cloud agent runs, environments, and secrets.
• Membership - A user belongs to one workspace and can belong to multiple teams within it.

Workspace roles

Every workspace member has one of three roles:

• Member - Uses Warp within their teams and the policies admins configure.
• Admin - Manages workspace membership, billing, and settings. Admins can view and manage every team, including teams they don’t belong to.
• Owner - Has every admin capability and can transfer ownership to another member. Each workspace has one owner.

In team member lists, the Workspace admin and Workspace owner badges distinguish workspace roles from team roles.

Workspace admin permissions

A workspace admin has admin-level permissions on every team in the workspace, even on teams where their team role is Member. Team admins who aren’t workspace admins keep admin permissions only on their own team.

Workspace admins can:

• Manage members - View everyone in the workspace, promote members to Admin, demote admins, and remove members or other admins. Removing a member also removes them from every team in the workspace.
• Manage invitations - Send email invites, and enable, disable, or reset the workspace invite link and its approved email domains. See Joining a workspace or team.
• Manage teams - Create teams and manage any team. See Teams inside a workspace.
• Manage settings, billing, and spend limits - See Workspace settings and team settings and Workspace spend limits.
• View and manage cloud agent runs - See Cloud agent run visibility.

Changing workspace roles

In the Admin Panel, open Members and use the three-dots menu on a member’s row to promote, demote, remove, or transfer ownership.

• Roles are additive - Changing a workspace role never changes a member’s team roles. An admin who is demoted loses workspace admin access immediately but keeps any team admin role they already had.
• Only the owner transfers ownership - The previous owner becomes an Admin.
• The owner stays in place - Admins can’t remove the owner or change the owner’s role. To step down, the owner transfers ownership first.
• Leaving a workspace - Members of Enterprise workspaces can’t remove themselves. An admin removes them.

Teams inside a workspace

Workspace admins create teams from the Admin Panel and choose a visibility:

• Open - Any workspace member can see the team and join it immediately.
• Hidden - The team doesn’t appear in team discovery; an admin adds members directly.

Workspace admins can also manage every team’s membership and settings.

Joining a workspace or team

Workspace admins add users through invitations or domain capture:

• Workspace invite links - Add a user to the workspace and let them choose an Open team.
• Team invite links - Add a user to an Open team and its workspace.
• Email invites - Add a user directly to a workspace or team. Admins add users to Hidden teams this way.
• Domain capture - Automatically adds users who sign up with a verified company domain.
• Team discovery - Shows Open teams to unassigned users in the Warp app under Settings > Teams.

Unassigned users

An unassigned user belongs to the workspace but not to a team. Workspace admins can manage unassigned users and set a separate per-user spend limit for them in the Admin Panel.

Unassigned users cannot start cloud agent or factory runs until they join a team. Workspace-level billing and policies still apply to them.

Cloud agent run visibility

Workspace admins can view and manage every team-owned cloud agent run in the workspace, including runs that members of other teams started. They have the same access to a team’s runs as a member of that team.

Runs owned by an individual user rather than a team stay private to that user. Neither team admins nor workspace admins can see them. Members who aren’t admins see their own runs and their teams’ runs.

For how to open and steer a run, see Viewing cloud agent runs.

Workspace settings and team settings

Workspace admins configure company-wide policies in the Admin Panel. For supported settings, they can enforce a value across the workspace or select Respect Team Setting to let each team decide.

SSO and domain capture apply at the workspace level. When a workspace admin enforces a setting, team admins see it as locked.

Workspace spend limits

Workspace admins can set monthly limits for total, local agent, and cloud agent spending. They can also set a separate per-user limit for unassigned users. Team and individual limits remain independent, and the first applicable limit reached blocks further usage within its scope.

Related pages

• Team management - Create and manage teams
• Admin Panel - Configure settings enforced across a workspace or team
• Roles and permissions - Team-level roles and what each can do
• Single Sign-On (SSO) - Configure authentication for a workspace
• Enterprise billing - Credit pools, spend limits, and billing management