How to Set Up Team Workspaces in WormGPT AI

Why Workspaces Exist

Offensive security work is client-confidential by default. One engagement's findings must never appear in another's view, and a junior researcher must not be able to delete a report the day before delivery. Workspaces plus roles are how the platform enforces that.

A workspace owns its tests, findings, exploit paths, payload library entries, C2 records and reports. Membership is explicit, and every record carries the workspace it belongs to.

Step 1: One Workspace per Engagement

The single most important structural decision. Not one per team, not one per customer account — one per engagement.

Reasons this matters: isolation is a property of the container, exports are scoped to the container, and access can be revoked wholesale when an engagement closes. A shared workspace containing six clients' findings makes all three impossible.

Step 2: Assign Roles Deliberately

Four roles:

• Owner — the engagement lead. Full control, including membership.
• Admin — manages members and settings, can run and edit everything.
• Member — runs analysis, creates findings and reports.
• Viewer — reads findings and reports, changes nothing. Use for client stakeholders, junior shadowing and audit.

Give viewers to anyone whose job is to read. Half the value of a shared workspace is letting a client see progress without emailing PDFs.

Step 3: Invite the Right People

Invite by email, with the role chosen at invite time. Two practical rules:

• Invite client stakeholders as viewers, and only after the engagement agreement covers it.
• Remove members when the engagement closes, rather than relying on their goodwill.

For distributed teams, keep European and US-based members in the same workspace — time-zone spread is an advantage when findings are worked asynchronously in a shared container.

Step 4: Separate Personal Research

Personal workspaces are for your own experiments: a new technique, a payload idea, a training target. Keeping exploratory work out of client workspaces protects both — no accidental exports, no confused findings.

Step 5: Keep the Data Disciplined

Workspace structure only helps if the contents stay disciplined:

• Name tests and reports with the engagement prefix.
• Use the description field on sessions and findings — six months later, a description is the difference between a useful record and a title.
• Archive rather than pile up: close out completed work so the active list means something.

Step 6: Close the Engagement Cleanly

Export the workspace to Markdown or JSON, deliver it as the report appendix, and record the export date. Then remove non-essential members. The audit trail stays with the workspace; the access does not.

Key Takeaways

• One workspace per engagement: isolation, scoping and revocation all depend on it.
• Use viewer role for client stakeholders — visibility without edit rights.
• Keep exploratory work in personal workspaces, never in client containers.
• Fill description fields; they are what makes records usable later.
• Close engagements with an export and a membership cleanup.

FAQ

Can two teams share one workspace? Yes, but they share everything in it. If two teams must not see each other's findings, they need separate workspaces.

Does a workspace limit who sees the payload library? Library entries are workspace-scoped, so a payload saved in one engagement is not visible in another unless copied.

Can I move findings between workspaces? Treat each workspace as a boundary. Reproduce the analysis in the correct workspace rather than exporting client A's data into client B's container.

How many members can a workspace have? Team sizing is a licensing question rather than a technical one — team and enterprise licences cover multi-seat use. Ask through the contact form for a quote.