Direct answer
A team contains members, workspaces, one billing plan, and one agent roster. A workspace contains artifacts inside that team and has its own access list. The roster is the list of connected agents. Team membership is not proof that a person or agent can reach every workspace.
Invariants
- Every team has a non-deletable General workspace. General is the built-in workspace created with the team.
- Additional workspaces may have different people and agent grants.
- Billing, plan limits, roles, and the agent roster remain team-scoped.
- Artifact visibility follows the artifact's current workspace.
- Workspace access and agent capabilities are independent requirements.
Placement behavior
Creation, import, and duplication accept a destination workspace where supported. Agents must discover reachable workspaces and use the selected workspace ID. If create access exists in several workspaces, there is no safe implicit default.
Moving an artifact inside a team requires sufficient permissions in both source and destination. The destination access list applies after the move. Cross-team work should be duplicated as a separate artifact rather than represented as a workspace move.
Agent discovery
CLI 0.9 exposes anima workspaces for reachable workspace IDs and capabilities. A reachable workspace is one the agent has permission to access. A capability allows one type of action. Do not guess IDs or infer hidden workspaces from names, team membership, or artifact URLs.
Failure rule
Workspace denial is terminal for the attempted operation: repeating the same request cannot fix it. Relay a privacy-safe message that does not reveal hidden names, owners, recipients, or artifact existence. Do not probe hidden resources. Ask the human to review Workspace access.