Guide: Account and Workspace Management

Use the account surface as the control plane for identity, security, and workspace membership.

This guide maps the signed-in account experience so users can update profile settings, secure the session model, and move cleanly between personal identity and workspace access tasks.

• Use /account as the main destination for profile, security, connected accounts, memberships, saved items, activity, and destructive actions.
• Treat email verification, password state, MFA posture, sessions, and trusted devices as one security workflow rather than isolated controls.
• Handle workspace joins and membership review from the account surface before you move into product workflows that assume a stable primary workspace.

Routes and surfaces

These are the product surfaces that currently define the account and workspace-management experience.

Recommended account loop

Follow this sequence so identity and workspace changes remain coherent across sign-in, verification, and downstream product access.

Security controls and review points

These are the concrete controls users will touch most often when they secure the account surface.

Session and trusted-device controls

• Use the current-session badge as the guardrail that prevents users from accidentally revoking the browser session they are actively using.
• The revoke-others action is the fastest way to clear stale device access after a password reset, role change, or suspicious sign-in event.
• Trusted-device labels, last-seen timestamps, and expiry timestamps give users enough context to distinguish routine remembered devices from risky ones.
• Document session and trusted-device review together because users usually revisit them in response to the same security concern.

Workspace operations

These controls define how personal identity and workspace reachability meet on the account page.

Audit and recovery

• Saved items and activity history help users explain why the account surface changed before they take recovery action.
• The activity card logs route and method context, which is useful when a user is tracing unexpected account or workspace changes.
• Sign-out-all and deactivate actions belong at the end of the page because they are destructive recovery controls, not routine navigation.
• Document the danger zone as the final escalation path after session review, MFA review, and connected-account checks have already happened.

Next steps