Organizations

A growing company runs many AxioRank workspaces, one per team, environment, or product. Administering them one at a time does not scale. An organization groups workspaces so you manage the cross-cutting concerns once. Organizations are an Enterprise feature, managed under Settings → Organization.

Consolidated billing

An organization carries a plan. Every workspace in the org inherits at least that plan as an entitlement floor, so you license the org once instead of each workspace. A workspace that pays for more on its own keeps its higher plan, the org floor never downgrades it.

Org plan: Team
├─ workspace "payments"   → Team (inherited)
├─ workspace "research"   → Team (inherited)
└─ workspace "platform"   → Enterprise (its own, kept)

Config templates

Keep your workspaces in lockstep without copy-paste. From Settings → Organization → Config template, pick a source workspace and push its governance, policies, response rules, custom detectors, and notification channels, to every other workspace in the org. It runs the same export → diff → apply machinery as config-as-code, so the result is exactly reproducible, and secrets are never copied (the export omits write-only fields).

Centralized sign-on

Configure your SAML identity provider once and require SSO across the org's workspaces. Any session that arrived through your IdP satisfies the requirement in every workspace, so one IdP integration covers all your teams. See Workspace security for SAML setup and the require-SSO policy.

Centralized model governance

An org can govern the AI models and provider credentials its workspaces use from one place, so a platform team sets the guardrails once instead of per workspace. It is managed under Settings → Organization.

• Credential inheritance: store a provider credential (OpenAI, Azure, Anthropic, Bedrock, Gemini, and the rest) once at the org and every workspace's AI Gateway uses it. A workspace needs no copy of its own, and rotating the org credential rotates it everywhere.
• Model provisioning: an org allowlist of the models workspaces may call. It is default-deny and enforced inline across every governed proxy surface (OpenAI chat and responses, Azure, Anthropic, Bedrock, and Gemini), so a model that is not provisioned is refused before the call leaves.
• Org spend cap: a spend ceiling across the whole org, on top of each workspace's own budget, so total model spend stays bounded even as teams are added.

Roles

Organization membership is separate from workspace membership:

• Owner: full control, including the org plan and membership.
• Admin: manage workspaces in the org and run config templates.
• Member: visibility into the org.

Attaching a workspace to an org requires you to own that workspace, so a workspace can never be pulled into an org by someone who does not control it.

Next steps

• Workspace security: SSO, MFA, and the controls each workspace still owns.
• Config as code: the export/apply behind config templates.