OUTCOMES
What this Prompt helps you deliver
- The collaboration-space structure is clear
- Roles and data boundaries are testable
BEFORE YOU START
Before you start
- An industry domain model exists
- Employees, customers, and external collaborators are listed
What AI should inspect first
docs/principleapps/tabtin_djangoapps/tabtin-electronREADY TO RUN
Complete Prompt
Copy the complete Prompt with its execution and acceptance boundaries.
Design team roles, permissions, and working spaces from real collaboration while preserving the Organization tenant boundary and single-root Workspace contract. Read AGENTS.md, docs/principle, apps/tabtin_django, and apps/tabtin-electron. Collect internal/customer/external roles, Agent identities, visible data, actions, approvals, long-term membership, Project-only participation, and private data boundaries.
Choose Organization and Project boundaries without using Organizations as ordinary projects or mixing customers in an unisolated space. Explain how members receive a Workspace, join a Project, and confirm a Task execution context. Build role × data × action for view, edit, assign, approve, export, and Agent management. Give customers/external members the minimum surface and a clear exit/revocation flow. Authorization belongs in backend queries/services; clients express capability and errors.
Replay one Project as internal admin, operator, customer viewer, external collaborator, and Agent. Deny cross-customer, cross-Organization, revoked, and guessed-URL access. A Workspace is not owned by a Project or Agent; external files require explicit authorization, not permanent mounts. Report structure, matrix, Workspace allocation, member lifecycle, API/client changes, tests, and compliance decisions.