Resource hierarchy

Taxonomy organises everything into three kinds of container: an organisation at the top, groups that act as folders within it, and workspaces that hold your resources. This page describes how they nest and the rules the service enforces.

The three resources

Organisation

An organisation is the root of the tree. It has no parent and sits above everything else. It carries a name and an owner, an identity from IAM. Every group and every workspace belongs to exactly one organisation.

Group

A group is a folder that organises workspaces within an organisation. Groups form a tree of their own: a group is either root-level, directly under the organisation, or a child of another group, and nesting can go as deep as you need. A group carries a name and an optional description.

Workspace

A workspace is the isolation boundary every other service builds on. It belongs to an organisation and may optionally sit inside a group; when it names no group, it rests directly at the organisation root. A workspace never contains other workspaces or groups, so it is always a leaf of the tree.

Containment rules

The service guarantees:

• Single parent. A workspace belongs to exactly one organisation and at most one group. A group belongs to exactly one organisation and has at most one parent group.
• No cycles among groups. A move is rejected if it would place a group inside itself or inside one of its own descendants, so the group tree stays acyclic.
• Organisation-scoped moves. A group or workspace cannot move between organisations. Only its position within its organisation changes, by moving it to a different parent.

Why the hierarchy matters

Groups exist so that access control composes. An access binding granted on a group automatically covers every workspace placed inside it, so moving a workspace into a group is also an authorization decision, not just an organisational one. See the security baseline for scoping guidance.