> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vistazo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> Asset ownership and the identity surfaces behind enterprise provisioning.

The MCP face of **Settings → General → Assets** and **→ Identities**. Admin-gated like the tools above; the absorption and identity tools additionally require the Enterprise tier.

| Tool                                                      | What it does              |                   |
| --------------------------------------------------------- | ------------------------- | ----------------- |
| [`list_governed_assets`](#list_governed_assets)           | List governed assets      | Read-only         |
| [`reassign_owner`](#reassign_owner)                       | Reassign owner            | Destructive write |
| [`list_absorptions`](#list_absorptions)                   | List absorptions          | Read-only         |
| [`exclude_absorption`](#exclude_absorption)               | Exclude absorption        | Destructive write |
| [`list_external_memberships`](#list_external_memberships) | List external memberships | Read-only         |

## list\_governed\_assets

`Read-only`

List the workspace's assets that need an owner decision, in two lists: `assets` — dashboards, skills, and chats whose owner of record holds no membership here (directory deprovisioning and workspace absorption both leave these behind); and `cappedAssets` — assets owned by a view-only member, who can no longer edit them. Each row is kind, id, name, and ownerUid. Use with reassign\_owner to re-home a row; resolve recipient names to uids with list\_workspace\_members. An empty result means nothing needs attention. Requires workspace admin.

## reassign\_owner

`Destructive write`

Move ONE asset's ownership of record to a full workspace member — the repair for a row from list\_governed\_assets. You supply the workspace, the asset `kind` (dashboard | skill | chat), its id, and the recipient's uid. The recipient must be a full member on a builder seat (guests, view-only members, and viewer seats are refused with the reason); reassigning to the current owner changes nothing. A dashboard's previous owner keeps editor access; a skill's or chat's previous owner keeps only the explicit grants they already held, if any. Recorded in the audit log. Requires workspace admin.

## list\_absorptions

`Read-only`

List the workspaces this Enterprise organization is absorbing after domain verification: `pending` claims still in their notice window (with the deadline and live counts of the dashboards, skills, and chats that would move), `paused` claims held by the circuit breaker (support releases those, not you), and recently completed moves with their refund outcome. Excluded claims are never listed. Each row names the source workspace, its owner, and whether it is a personal workspace. The only admin action on a claim is exclude\_absorption. Requires workspace admin and the Enterprise tier.

## exclude\_absorption

`Destructive write`

Call off one pending absorption during its notice window — the opt-out for a genuine side project on a work email. You supply the enterprise workspace and the source workspace id from list\_absorptions. Terminal: an excluded workspace is never claimed again by this organization. Refuses a claim that is no longer pending (paused claims belong to support; completed moves are history); excluding twice is not an error. There is no approve — verifying the domain was the approval. Recorded in the audit log. Requires workspace admin and the Enterprise tier.

## list\_external\_memberships

`Read-only`

List where this organization's SSO identities hold memberships in OTHER workspaces: one row per identity per external workspace, with the person's uid, name, and email, the external workspace's id and name, their role there, and whether it is a guest (share-by-email) membership. Read-only — revoking an external membership is that workspace's decision, and deprovisioning the identity in your directory removes all of them. Requires workspace admin and the Enterprise tier.