Give people, organizations, services, and agents distinct authority.
An action has an actor and an authority context. Distinguish a person acting for themselves from a service or agent acting on someone's behalf.
Workspace membership defines the powers granted to each participant. Reading, writing, administration, ownership, and hosting are independent powers; one role name does not imply every other permission.
A person might read one workspace, contribute changes to another, and administer a third. Linking those workspaces does not combine their permissions.
For example, an accountant can work with a company's financial workspace without gaining access to its personnel records. A service receives the authority its job needs.
Membership answers who has authority. An agreement describes the purpose and terms of a particular use. Both matter when work crosses organizational boundaries.
Provenance connects resulting changes to their actors. Agent work applies the same access boundaries to automated participants.
Developer reference
Decentralized identifiers follow W3C DID Core. Distinguish acting principal, executor, session and funding account. A cryptographic signature proves control of the signing key; grant evaluation determines which operation that identity may authorize.
Workspace roles are independent capabilities, not an implicit administrator-to-reader hierarchy. Membership, operation authorization and workspace-key delivery have distinct predicates and lifecycles.
Review (principal, workspace, action, scope, expiry/revocation) together. Web-edge authentication establishes a session; backend admission still resolves the relevant authority. Delegation must preserve the accountable principal. Linked workspaces retain separate membership sets and encryption boundaries.