Workspaces: limit AI access to your team's documents

Workspaces determine which people and which chatbots may see which content; databases structure the knowledge within them.

A workspace is a self-contained work and knowledge space within a tenant. It has its own knowledge base with folders and documents, its own databases, tasks, an assignable calendar and a member list with roles. It is therefore not a folder with sharing checkboxes but the object to which permissions are attached.

The difference is practical. A folder share describes who may open a file. A workspace describes which body of knowledge exists at all for which people and which programs. Only the second question determines what an AI assistant can use in an answer.

Company knowledge should be findable in one central place, yet not everyone may see everything. Personnel files, draft contracts, cost calculations and client documents belong to different circles. In folder structures that have grown over time, this conflict is resolved through hundreds of individual shares that, after a few years, nobody can fully keep track of any more.

An AI assistant makes the situation worse. A semantic search finds content by its meaning, not by file name. As a result, it also brings to light things that nobody would have searched for deliberately. Anyone who points an AI at an undivided collection of all content makes every accidental share from past years retrievable in one go.

The restriction is not an instruction to the language model but a check that comes before it. A model that is supposed to ignore a passage has already seen the content. A check that applies beforehand never delivers it in the first place. Four levels work together.

1. Step 1

   Tenant

   The top-level boundary runs between customer companies. Data isolation takes place per tenant at database and vector store level, and no two companies share an index.

2. Step 2

   Workspace

   Within a tenant, the workspace separates knowledge spaces by team, department or project. Each workspace has its own knowledge base, which forms the complete search space for searches and answers.

3. Step 3

   Role

   Within a workspace, a distinction is made between the roles Admin, Member and Viewer. The role is assigned per workspace, so the same person can have different roles in different spaces.

4. Step 4

   Individual request

   With every access, the server checks the permission again, on every API endpoint. The check therefore does not sit in the interface but behind it.

The workspace boundary applies to every point of access to company knowledge, not just the file browser. This affects three places that would otherwise each need their own permissions model.

• Nex, the AI assistant, answers from the workspace in which the question is asked and cites the source from exactly that content.
• The semantic document search searches the same restricted index, both in the chat and in its own search window.
• A Chatbot is assigned to exactly one workspace. A bot for website visitors therefore receives only the knowledge space intended for the public.

• A Nexoria core product, Base or Pro plan. Workspaces are included and are not an add-on. The terms are on the pricing page.
• Content intended to serve as company knowledge is stored in Nexoria Drive and is assigned to the respective workspace.
• A decision on which knowledge spaces there should be. This structure is an organisational question and cannot be derived from a folder structure that has grown over time.
• Members are added by email address and are given a role. People outside your own company can also be invited.

• Separate knowledge spaces for departments and projects, each with its own knowledge base.
• Structured databases per workspace, for content that does not exist as a file.
• Member management with the roles Admin, Member and Viewer.
• Invitation by email address, including across company boundaries.
• Collab workspaces as a shared area with external partners.
• Assignment of a chatbot to exactly one workspace.
• Tasks and calendars can be assigned to a workspace and are visible to its members.
• Automatic indexing of a workspace's content for document search and Nex.

Where this component fits into the overall picture is shown in the component overview.