Workspace and IAM tasks¶

List workspaces before selecting one, then save the workspace to configuration. Member and role operations must specify a target workspace, and permissions should be confirmed before a write.

moi-cli -o workspace list
moi-cli config set-workspace "<workspace-id>"
moi-cli -o workspace-member current-principal
moi-cli -o workspace-member members

The list output contains workspaces visible to the current identity. Use current-principal to confirm that identity before a write, and members to confirm whether the target account is already a member of the workspace.

Manage workspaces and members¶

Task	Commands	Notes
Create, claim, or delete a workspace	`workspace create`, `workspace claim`, `workspace delete`	Confirm the workspace and dependent resources before deletion.
Manage workspace members	`workspace-member`	Use it to invite members, set roles, update state, or remove a member.

Check command help before supplying the target member, role, and workspace:

moi-cli workspace --help
moi-cli workspace-member --help
moi-cli iam --help

Creating or deleting a workspace, inviting a member, and changing a role or member state all change the access scope. After a write, run workspace list, workspace-member members, or the corresponding query subcommand again to confirm the result.

Ensure that a workspace exists¶

workspace ensure --name <workspace-name> first looks for a workspace with that name that is visible to the current identity. If there is no exact match, it creates a workspace, so it is not a read-only check.

Use it only when the caller explicitly permits workspace creation. To reuse an existing workspace in automation, list workspaces first, save the confirmed workspace ID, then set it with config set-workspace or the global -workspace-id option.

Manage roles and object grants¶

Task	Commands	Notes
Manage member roles	`workspace-member`	Manages roles in a workspace.
Inspect permissions and roles	`permission-schema`, `roles`	Read existing permissions and roles first.
Manage roles	`create-role`, `update-role`, `update-role-lifecycle`	Use confirmed role identifiers.
Validate or write object grants	`validate-object-grants`, `apply-object-grants`	Validate before writing; use `--json` or `--json-file` for complex input.
Delete a role	`role-delete-impact`, `delete-role`	Review the impact before deletion.

workspace-member manages a member’s roles in a workspace. iam manages role definitions and object grants. Start by reading the permission schema and existing roles:

moi-cli -o iam permission-schema
moi-cli -o iam roles

Query member audits and user tags¶

Task	Commands	Notes
List member tags	`user-tags`	Reads tags subject to workspace permissions.
Manage member tags	`create-user-tag`, `update-user-tag`, `delete-user-tag`	Confirm the target member and tag before a write.
Read member audit records	`audit-logs`, `audit-log-overview`	Audit records report actions that already happened.

Audit records report actions that already happened; they do not revert role, member, or permission changes. Tags and audit queries remain subject to workspace permissions.

Get database connection information¶

To retrieve database connection information for the selected workspace, run:

moi-cli -o account db-connection

The output can contain connection credentials or addresses. Do not save it to shell history, CI logs, or source control; use it only through protected deployment configuration after confirming the workspace.

Last updated on Sep 8, 2026