Plan your workspaces
How to lay out workspaces for your organization: when a piece of work gets its own workspace, which kinds to have, who gets which role, and what to do before, during and after the work.
How to create a workspace and invite people is on Organizations and workspaces. Who may create workspaces, and how to close one, is on Workspaces.
The rule
A workspace is a trust boundary, not a filing cabinet. Make a new workspace when who may see the work changes. Use a folder when only the topic changes.
“Who may see the work” changes in two ways:
- A different set of people works on it.
- A rule must keep some people out, such as a conflicts check, an information barrier, an independence rule or a client’s confidentiality agreement.
Before you create a workspace, ask:
| Question | If yes |
|---|---|
| Will someone in the existing workspace have to be kept out? | New workspace |
| Is it client or deal work with a defined end? | New workspace, or a folder in that client’s workspace (see Client or engagement) |
| Are its people different from those of every existing workspace? | New workspace |
| Is it only a new topic for the same people? | Folder in the existing workspace |
Why agents make it matter
An agent can read whatever its workspace can reach. Anything filed in the wrong workspace is something an agent can find, quote and build on, for anyone in that workspace who asks. Put work where its audience is before agents start on it.
By default a workspace also shares with a member’s other workspaces: Used in other workspaces and Used here from other workspaces both start On. Turn them off for any workspace whose content must stay inside it; see Workspace settings.
Kinds of workspace
| Kind | What goes in it | Who is in it | Settings |
|---|---|---|---|
| Firm-wide | Policies, templates and the agents everyone uses. Never client data. | Everyone | Discoverable |
| Practice or team | Reusable knowledge, skills and past work with client details removed | Members of the practice or team | Discoverable or Invite only |
| Client or engagement | One client’s sources, work and deliverables | The engagement team | Invite only; Used in other workspaces off |
| Restricted | Compliance, HR, leadership, or a deal team behind an information barrier | Only the people the rule allows | Invite only; both reuse settings off |
| Build | Agents, skills and applets built and tested on non-client data before they’re shared wider | The people who build them | Invite only |
| Personal | Drafts and anything not ready for a team | One person | Your files (My Drive on the newer permissions system); not a workspace |
One workspace per client, with engagements as folders, is the default. Make a separate workspace for one engagement only when a barrier, an independence rule or a confidentiality agreement means some of that client’s team must not see it. This keeps the number of workspaces down, and suits small teams.
Choosing roles
Give each person the lowest role that does the job. A typical mapping for a professional services firm:
| Person | Workspace role |
|---|---|
| Partner or engagement lead | Owner |
| Engagement manager | Admin |
| Team doing the work | Member |
| Risk, compliance, quality review or internal audit | Viewer |
People who check the work without doing it, such as risk, compliance and quality reviewers, need to read but not change. Viewer can look at chats and shared items but can’t edit or send chats. For a role in between, create a custom role in Workspace settings > Roles. What each role can do is on Roles.
Staffing a workspace
- Make a user group for each engagement team and add the group to the workspace, so everyone gets the same role in one step. User groups are on organizations that use the newer permissions system; see Set up your organization. Groups are kept by hand: provisioning from your identity provider doesn’t sync them. Without user groups, add each person to the workspace.
- Expect people to be in several workspaces. Partners and managers often work on several engagements at once. Pinning and hiding workspaces keeps the list short.
- Remove people when they roll off. Take them out of the group, or out of the workspace, as soon as they leave the engagement. Removal is a routine step, not an exception.
- Adding a person doesn’t add their agents. Once they’re in, Context asks them which agents to bring in. Bring only the agents the work needs.
Before and after the work
- Check first. Run your conflicts or independence check before the workspace exists, not after.
- Create the workspace. Use Invite only, turn off Used in other workspaces, write the default agent instructions, and add the team’s group.
- Review access while the work is live. Each change to who has a role in the workspace is recorded in the audit log.
- At close, move reusable lessons, with client details removed, to the practice workspace. Then remove the team, keep the owner and turn off both reuse settings.
- Keep the workspace until your retention period ends. Deleting a workspace deletes everything in it and can’t be undone.
Context has no archive and no retention lock. A closed workspace stays open to its remaining members, and its owner or an organization admin can still delete it. See Data retention.
Who may create workspaces
By default, Members can create workspaces. That suits a small firm where everyone knows the work.
Once you have client or regulated work, make creating workspaces admin-only, so each new workspace is checked and set up the same way. Take Create workspaces off the Member role; see Workspaces.
Regulated work
Short notes on how some common rules map to workspaces. Each links its rule. This is not legal advice; check with your compliance team.
Banks and broker-dealers. Deal teams on the private side must be kept apart from research and trading on the public side, and crossing that barrier is a formal, recorded step (SEC staff report on information barriers, FINRA Rule 2241, FINRA Rule 5280). In Context:
- make a Restricted workspace per deal or code name;
- treat adding someone to it as the wall crossing, which the audit log records;
- give compliance Viewer;
- turn off both reuse settings.
Audit firms. Some non-audit services impair independence (SEC Office of the Chief Accountant, IESBA Code). Keep audit and advisory work for the same client in separate workspaces. The engagement quality reviewer reviews but must stay objective (PCAOB AS 1220), so give them Viewer.
Records. Regulated firms must keep records for years after the work ends, for example audit documentation (PCAOB AS 1215), broker-dealer records (SEC Rule 17a-4, FINRA Rule 4511) and investment adviser records (Rule 204-2). Don’t delete a workspace that holds such records before its retention period ends.
Patterns to avoid
- A workspace per topic. Topics are folders. A new workspace for each subject multiplies the places people must be added and removed.
- Client data in the firm-wide workspace. Everyone, and every agent working there, can reach it.
- Folder-permission sprawl. A folder can be shared with its own people, but when a folder needs a different audience from the rest of the workspace, it belongs in its own workspace.
- Inviting clients as members. An invited person joins your organization as a full member. Share agreed deliverables item by item where your organization allows it, or use your client portal or data room.
- Leaving reuse on for client work. With Used in other workspaces on, a member’s agents in other workspaces can use the client’s files.
- Deleting at close. Deleting can’t be undone; keep the workspace until your retention period ends.
- Never removing anyone. People who have rolled off still see the work, and so do their agents.
Next steps
- Workspaces: who creates workspaces, adding people automatically and closing a workspace.
- Workspace settings: who can join a workspace and what is shared across it.
- Set up your organization: invite people, make user groups and set the default workspace.