A project tool that already knows your IT policies.
SSO via OIDC or SAML, provisioning via SCIM 2.0 or LDAP, permissions down to functional areas and open interfaces - you manage access, not exceptions.
- Directory sync
- Webhook deliveryRetrying
- AI token budget82 %
- Audit trail
Sound familiar?
The business buys a tool - and IT ends up running yet another island.
Yet another tool with its own passwords
No SSO, no provisioning, its own user management: every new tool becomes an island that nobody officially operates.
Permission sprawl
Who can actually see what? The answer lives in a spreadsheet from two years ago - and every exception breeds the next one.
On- and offboarding as busywork
New colleagues are added to every project by hand - and leavers stay active because deleting them would tear the history apart.
Automation and AI as a black box
Something changed a status, someone is using AI with company data - without a log, without a budget, without an off switch.
A working day with WORKSPACE.PM
From directory sync in the morning to AI governance in the afternoon: five stations where IT sets the framework.
New colleagues are already in
The directory has synced: accounts created, roles mapped, every run logged. You lift the new group into the project with one click - the project role travels along automatically.
User groups in detailCheck permissions instead of guessing
38 permission areas with up to four levels, globally and per project. Protected system roles prevent anyone from locking themselves out - and the per-role change history answers every compliance question.
Roles & permissionsWire a webhook to your own system
Signed webhooks with a rotatable secret and a full delivery log, plus the REST API with OpenAPI documentation. Test delivery included - you debug with a log instead of guesswork.
Integrations & interfaces- task.completed200
- risk.created200
- report.approvedRetry
Signed, rotatable secret - delivery log per endpoint
Automate an approval process
The process runs as a diagram with deadlines and escalation. Automated steps run under a system actor - cleanly separated from personal accounts, every process version with a changelog.
Workflow automation- Change status
- Trigger webhook
- Generate PDF
AI rollout under control
Per-person token limits are enforced server-side, every writing AI action needs confirmation - and when in doubt, the tenant-wide kill switch stops AI completely.
AI assistant & governanceLimit enforced server-side
And in between, your own project work: bugs, spikes and maintenance routines on the team board - the toolbox below takes you there.
Your toolbox
Six areas IT teams use to operate WORKSPACE.PM - and to work in it themselves.
Your IT in interplay
IT sets the framework - identity, permissions, interfaces. Every other role works safely within it.
PMO
Gets cockpits and reports from a system that enforces your permission and approval logic.
For the PMOIT
Identity, permissions and interfaces come from one place - one data base, one set of rules.
Executive management
Sees metrics without extra tools - every analysis within the permissions granted.
For executive managementBoards & committees
Decide on approved, immutable report snapshots - with proof instead of hearsay.
For committeesIT
Identity, permissions and interfaces come from one place - one data base, one set of rules.
PMO
Gets cockpits and reports from a system that enforces your permission and approval logic.
For the PMOExecutive management
Sees metrics without extra tools - every analysis within the permissions granted.
For executive managementBoards & committees
Decide on approved, immutable report snapshots - with proof instead of hearsay.
For committeesSecurity that does not become a burden
Control is enforced server-side - the standard case stays a matter of minutes.
Fits into your identity stack
Single sign-on via OIDC or SAML, provisioning via SCIM 2.0 or LDAP sync - self-service, secured through DNS-verified domains. And enforced SSO locks nobody out: the emergency account stays reachable.
Open standards instead of lock-in
Files can live in your SharePoint, CMIS DMS or S3 storage. The REST API with OpenAPI documentation and signed webhooks keep every exit open.
AI that knows your rules
Every writing AI action needs confirmation, permissions are never diluted, token budgets are enforced server-side - and the kill switch is yours. Optionally with your own key or locally hosted models.
Frequent questions from IT
What IT leads want to know before rolling out.
Single sign-on via OIDC and SAML, push provisioning via SCIM 2.0 and LDAP sync (e.g. Active Directory) - including mapping IdP groups to roles. Every provisioning run is logged.
38 permission areas - 18 global and 20 project-level - with up to four levels from none to administration. Custom global and project roles are freely definable, and every role change is recorded in the change history.
Yes: a REST API under /v1 with Swagger and OpenAPI documentation, per-tenant API keys and signed outgoing webhooks with a delivery log. API keys are deliberately simple, tenant-wide machine credentials. External AI clients connect through the MCP endpoint - via OAuth as an individual person, with that person's permissions.
Microsoft Teams runs through a central app - no own Azure registration - with interactive cards acting under the linked person's identity; the integration is being rolled out in stages. Beyond that: Zapier, Trello import and Miro embedding.
You generate the data processing agreement under Art. 28 GDPR as self-service - with an immutable version archive. Plus: a support allowlist, tenant self-deletion with double confirmation, and deactivate-instead-of-delete until final GDPR erasure.
Set the framework - the system handles the rest
Try WORKSPACE.PM free for 30 days - with SSO, permissions and interfaces the way your IT expects them.