# Workspaces and Permissions

Engage Studio uses **Workspaces** and **Policy-Based Permissions (PBP)** to manage access and governance. This ensures that your teams can collaborate securely, with clear separation between brands, regions, or business units.

## 1. Understanding Workspaces

A **Workspace** is a secure container for your marketing assets. Everything you build in Engage Studio belongs to a specific workspace.

### Why use Workspaces?

* **Isolation**: Separate assets by brand or region (e.g., "Japan Marketing" vs. "US Marketing").
* **Governance**: Control which Email Domains, Custom Web Subdomains, and Audience Segments are available to each team.
* **Security**: Prevent accidental access to sensitive data or unauthorized sending.


### Workspace Structure

Each Workspace contains:

* **Campaigns**: The journeys and activations.
* **Landing Pages**: Static campaign destinations created in this workspace.
* **Templates**: Email designs and content.
* **Senders**: Verified sender profiles authorized for use in this workspace.
* **Workspace Settings**: Configuration of available *Email Domains*, *Custom Web Subdomains*, and *Parent Segments*.


### How to Create a Workspace

1. Navigate to **Engage Studio > Workspaces**.
2. Click **Create Workspace**.
3. Enter a unique **Name** and optional **Description**.
4. Click **Save**.


![Workspace Overview](/assets/permission-workspace-overview.48bbd569da65a4f02e0b02acb8452b6abb2c694935a3f9fb691c1aa87033cbaf.5be018a0.png)

### Configuring Workspace Resources

Once created, an Admin must assign resources to the Workspace:

1. **Email Domains**: Select which verified sending domains (configured by IT) can be used.
2. **Custom Web Subdomains**: Select which registered, Active Landing Page custom subdomains are available to this workspace. Marketers can select only the subdomains assigned to their workspace. When a subdomain is assigned to multiple workspaces, coordinate the URL slugs used by each workspace because a slug must be unique across landing pages using that subdomain.
3. **Parent Segments**: Select which CDP segments are visible for targeting within this workspace.


## 2. Managing Permissions (Policy-Based Permissions)

**Policy-Based Permissions (PBP)** allow you to define granular access controls. Instead of simple "Admin" or "User" roles, you create **Policies** that define exactly what a user can do.

### Permission Groups

Landing Pages and Landing Page custom subdomains do not have dedicated permission entries in the policy screens. Access is derived from these existing groups:

| Permission group | How it affects Landing Pages |
|  --- | --- |
| **Workspace Configuration Permissions** | Control workspace administration and assignment of available resources, including custom subdomains. |
| **Workspace Feature Permissions** | The existing `EngageCampaign` **View**, **Edit**, and **Launch** permissions control viewing pages and uploads, managing drafts and uploads, and publishing or unpublishing pages. |
| **Domain Permissions** | The existing `EngageDomain` **view** and **edit** permissions control web-domain status and operations. `EngageDomain` covers both Email Domain and Web Domain. |


A user must have access to the target workspace and the appropriate permissions in these groups. Landing Page operations follow the user’s existing Campaign permissions, while web-domain operations use the account-scoped Engage Domain permission.

### How to Configure Policies

Permissions are managed in the **Control Panel**, not inside Engage Studio itself.

1. Go to **Control Panel > Policies**.
2. Create a new Policy or edit an existing one.
3. Scroll to the **Engage Studio** section.


#### Configuration Areas

* **Configurations**: Who can manage Workspaces, Domains, and Parent Segments? (Usually Admins).
  * ![Configuration Permissions](/assets/permission-policy-configurations.bc707ec6fc772f31994c04d4df49778b247f789898c0c08eb5746ef3b1b0066f.5be018a0.png)
* **Features**: Who can build campaigns and templates? (Marketers, Designers).
  * ![Feature Permissions](/assets/permission-policy-features.e6169e4638ae3834f745acb21544338d796d27e7adb5e1216d93e3061709a64f.5be018a0.png)
* **Domains**: Who can view and manage email and web domains? (IT/Admins).
  * ![Domain Permissions](/assets/permission-policy-domains.ff57cb189cf3d06de18ea0fa2dcb5affaa48b59edf0b3a04d7bad7ad27d719e7.5be018a0.png)


### Common User Roles (Examples)

| Role | Recommended Permissions |
|  --- | --- |
| **Marketing Manager** | **Edit** Campaigns/Templates, **Launch** Campaigns. Access to specific Workspaces. |
| **Content Designer** | **Edit** Templates. **View** Campaigns. No Launch access. |
| **Analyst** | **View** Campaigns and Reports. No Edit access. |
| **IT Admin** | **Full Access** to Configurations and Domains. |


## FAQ

**Q. Can I share an Email Domain across multiple Workspaces?**
Yes. A verified domain (e.g., `marketing.example.com`) can be assigned to multiple workspaces.

**Q. Can I move a campaign to another Workspace?**
No. Resources are bound to the workspace where they were created.

**Q. Who "owns" the campaign launch?**
Campaigns run under the permissions of the user who activates them, but the resources used (Senders, Segments) are scoped by the Workspace.