list_governed_assets
Read-only
List the workspace’s assets that need an owner decision, in two lists: assets — dashboards, skills, and chats whose owner of record holds no membership here (directory deprovisioning and workspace absorption both leave these behind); and cappedAssets — assets owned by a view-only member, who can no longer edit them. Each row is kind, id, name, and ownerUid. Use with reassign_owner to re-home a row; resolve recipient names to uids with list_workspace_members. An empty result means nothing needs attention. Requires workspace admin.
reassign_owner
Destructive write
Move ONE asset’s ownership of record to a full workspace member — the repair for a row from list_governed_assets. You supply the workspace, the asset kind (dashboard | skill | chat), its id, and the recipient’s uid. The recipient must be a full member on a builder seat (guests, view-only members, and viewer seats are refused with the reason); reassigning to the current owner changes nothing. A dashboard’s previous owner keeps editor access; a skill’s or chat’s previous owner keeps only the explicit grants they already held, if any. Recorded in the audit log. Requires workspace admin.
list_absorptions
Read-only
List the workspaces this Enterprise organization is absorbing after domain verification: pending claims still in their notice window (with the deadline and live counts of the dashboards, skills, and chats that would move), paused claims held by the circuit breaker (support releases those, not you), and recently completed moves with their refund outcome. Excluded claims are never listed. Each row names the source workspace, its owner, and whether it is a personal workspace. The only admin action on a claim is exclude_absorption. Requires workspace admin and the Enterprise tier.
exclude_absorption
Destructive write
Call off one pending absorption during its notice window — the opt-out for a genuine side project on a work email. You supply the enterprise workspace and the source workspace id from list_absorptions. Terminal: an excluded workspace is never claimed again by this organization. Refuses a claim that is no longer pending (paused claims belong to support; completed moves are history); excluding twice is not an error. There is no approve — verifying the domain was the approval. Recorded in the audit log. Requires workspace admin and the Enterprise tier.
list_external_memberships
Read-only
List where this organization’s SSO identities hold memberships in OTHER workspaces: one row per identity per external workspace, with the person’s uid, name, and email, the external workspace’s id and name, their role there, and whether it is a guest (share-by-email) membership. Read-only — revoking an external membership is that workspace’s decision, and deprovisioning the identity in your directory removes all of them. Requires workspace admin and the Enterprise tier.