# Operating JustFlows

These are customer-facing capabilities you should understand well enough to configure plans, reproduce problems, and guide workspace owners.

## Workspaces & teams

A workspace is the ownership and billing boundary for orchestration resources. Workspace owners and permitted members can invite teammates, assign roles, switch workspaces, and collaborate on flows and approvals.

- Member limits include the workspace owner and pending invitations.
- Only authorized workspace roles can manage billing, secrets, integrations, or destructive actions.
- Removing a member should not be treated as deleting the resources they helped create.
- Account deletion can be blocked while the user owns a shared workspace or has active operations/billing.

Administrators can inspect workspaces and members from the admin panel when supporting a customer. Use impersonation carefully and record why it was necessary.

## AI accounts

Workspace AI Accounts hold provider credentials used by that workspace's agents. A customer should:

1. open AI Accounts and choose a provider;
2. save the API key and any custom base URL required by that provider;
3. select the account when configuring an agent;
4. run a small test before using it in a published workflow.

Credentials are secrets. Workspace members only see or reveal them according to their permissions. When rotating a key, re-test every agent that depends on the affected account.

## Agents, prompts & skills

- **Agents** combine an AI account/model with instructions and optional capabilities. Plan limits control how many a workspace can create.
- **Prompts** are reusable, versioned instructions. Versioning gives workflows a stable reference and an audit trail.
- **Skills** add reusable behavioral guidance or domain-specific instructions to an agent.

Keep agents focused. Give tools and data access only when required, test structured outputs, and use lower-variance settings for automation that must return predictable fields.

## Knowledge & MCP

Knowledge bases store workspace sources that an agent can use as context. Plan entitlements limit both the number of knowledge bases and their stored source size. When ingestion fails, check the chosen storage driver, upload limits, file type, worker, and logs.

MCP servers expose additional tools to the workspace. Add the server URL and credentials, validate the connection, and discover capabilities before attaching it to an agent or flow. Treat an MCP server as privileged code: review who operates it, what tools it exposes, and what data it can access.