The three levels, the two roles, and who can change what.
| Level | Answers | Owns |
|---|---|---|
| Workspace | Who can see this, and who can change it | People and projects |
| Project | Which product is this | Log events, sources and boards |
| Source | Which thing wrote this event | Nothing |
A source is one thing that writes events: a website, a desktop app, a backend, a cron job. There is only the one kind. Each has a public key of the form fr_<16> that names a destination and authorises nothing: it cannot read a number, a board or a person. Events from every source land at https://app.firstrun.app.
One project per product is the advice, because that is what makes a board readable. It is not a data-safety rule: sources are never linked to each other, so getting it wrong puts numbers on the wrong board rather than corrupting them.
Admin changes things: projects, sources, boards, and who else is in the workspace. Read looks. There is nothing in between.
Membership is per workspace and covers every project in it. There is no per-project access, so two groups who should not see each other’s numbers need two workspaces. Every check runs on the server, on every change; the interface hides buttons a reader cannot use as a courtesy, not as the check.