workspace permissions, defaults