# Workspaces

What a workspace is, how to switch between them in the CLI and the Console, and why selecting one never widens what you can do.

A workspace is your view of one organization and one of its tenants: the pair, your role there,
and the capabilities you hold. It is a selection, not a resource. You choose it once per context;
the server re-derives your access from the token, the organization, and the tenant on every
request.

- A workspace is one organization plus one tenant, with your role and capabilities there.
- `tanomis workspace use ORG --tenant TENANT` selects it per context; `show` prints it.
- Selecting supplies context and never widens access; grants are re-checked on every request.

## Switch in the CLI

```bash title="Terminal"
tanomis workspace ls
tanomis workspace use northwind --tenant northwind-sandbox
tanomis workspace show
tanomis workspace clear
```

`use` persists the selection on the active context; `show` prints it beside the role and
capabilities; `clear` removes it. Tenant-scoped commands then send the organization and tenant
selectors for you, and refuse an explicit `--tenant` that disagrees with the selection.

## Switch in the Console

The organization and tenant you are working in appear in the header. Settings shows the
workspaces you can select. Where the switcher is not yet available in your environment, sign in to
the organization you need.

## Switch in your application

Applications do not select a workspace; they send it on every request as the
`X-Organization-ID` and `X-Workspace-Tenant-ID` headers, from the pair returned by
[List workspaces](/api/workspaces/list-workspaces).

## What selecting cannot do

Selecting a workspace supplies context. It cannot attach a tenant, grant one, or reach one you are
not granted; a selection outside your grants fails at the first server-backed call. Grants can
change at any time and take effect on the next request.

## Where to go next

- [Organizations and tenants](/concepts/organizations-and-tenants)
- [Authenticate and select a workspace](/getting-started/authenticate-and-select-workspace)