On most platforms, a workspace is where it was created, forever
You can export the data and rebuild somewhere else, losing the history, the addresses other people send to, the grants, and the audit trail in the process. Moving a project to a new region, handing it to a successor, or relocating it to a partner organization is a migration project, not an operation.
Here a workspace or a clean room is a first-class object with a stable identity, and the plane that moves it is one mechanism graduated by trust. The difference between copying it and moving it is the difference between two identities and one, and the platform refuses to blur them.
Clone is a copy. Migrate is a move. They are not the same thing.
A clone mints a new identity and address; the source is kept and diverges. A migrate retains the identity, address, inbox and feed and only changes where the workspace lives. Relocating across an organization boundary is that same move with a trust overlay on top, not a second, riskier data path.
| Operation | What it does, and what it guarantees |
|---|---|
| Clone | A same-organization copy that mints a new identity and routable address. The source is kept and diverges from the copy, so a clone-for-test can be null-routed and expiring, and never receives the original's live inbox or feed. |
| Migrate | An identity-preserving move: the same identity, address, inbox and feed are retained while the home placement changes. A fail-closed check refuses any plan that would mint a new address or move the default flag. That would be a clone wearing a migrate label. The source is fenced, then retired only once the destination is proven healthy. |
| Relocate across organizations | The same move mechanism with a trust overlay: consent from every owning organization, a decrypt-then-reseal under the destination's key, secrets withheld and re-provisioned at the target, a residency gate and a default-deny egress review. Cross-org is one mechanism graduated by trust, not a second data path. |
| Snapshot and rollback | A point-in-time state is sealed content-addressed and immutable; a rollback verifies the seal before it applies anything and refuses a missing or tampered snapshot, so there is no partial restore. |
| Forensic quarantine | A possibly-compromised workspace is isolated behind a read-and-routing fence with a chain-of-custody record. Lifting it is deny-closed, it requires an explicit re-attestation, never an empty authorization. |
| Reassignment and succession | Ownership transfer, offboarding and delegation run through the same audited lifecycle, with legal-hold and retention handling, so a departing owner never orphans a workspace. The identity-preserving mechanisms are built; the operator surface for succession-while-active is being finished. |
| DR failover and failback | Failover is an unplanned routing cutover, all-or-nothing across the planes under a completeness gate, with the home re-point withheld unless every plane promoted cleanly; failback reverses it. The same routing primitive a planned migration reuses. |
The identity-preserving move, stated precisely
A workspace’s address has two halves: the logical address a sender targets, which must stay stable, and the physical home, the node and cell it lives on right now, which a move rewrites. A migrate carries the logical address, the inbox and the feed unchanged and repoints only the home. A fail-closed check runs before any effect: a plan that would mint a new address or move the default flag is a clone wearing a migrate label, and it is refused. The source is fenced, then retired only once the destination is proven complete and healthy.
That mechanism is built and carries single-cell and multi-cell tests. The operator surface that invokes an identity-preserving move and a succession-while-active is being finished, so we describe the guarantee here rather than imply a one-click action today. The wired operations below are ones an operator drives now.
The operations, driven from one plane
Each is a composition of the same primitives, a resource-graph copy plan, a placement- and protection-preserving mover, a reconcile-before-commit gate, and a fenced rollback window, so they behave consistently and each writes to the workspace’s own tamper-evident mobility record.
Clone
Copy a workspace or clean room into a new identity and address, for a golden onboarding template, or a null-routed, auto-expiring test copy that never receives the original's live inbox or feed. The source is kept and diverges from here.
Snapshot and rollback
Seal a workspace's state at a point in time, content-addressed and immutable, and return the live workspace to a named seal. A rollback verifies the seal before it applies anything, a missing or tampered snapshot is refused, so there is no partial restore.
Forensic quarantine
Isolate a possibly-compromised workspace behind a read-and-routing fence with a chain-of-custody record, who, why, the incident reference. Lifting it is deny-closed: it takes an explicit re-attestation, never an empty authorization.
Merge and split
Fold one workspace into another under a conflict policy, or split a new identity out, with the merged-away name aliased to the survivor for a grace window, so senders that still target the old address resolve rather than break.
Archive and restore
Move a workspace to cold retention and bring it back as itself, references repointed, under legal-hold and retention rules, cold storage that is a lifecycle state, not a data graveyard you cannot get out of.
DR failover and failback
Fail a workspace over to a standby with no data move, then fail it back, all-or-nothing across every plane under a completeness gate, with the home re-point withheld unless each plane promoted cleanly. The same routing primitive a planned move reuses.
Stated precisely, with the number measured
8
planes that move together.
6
disaster-recovery operations per workspace.
9
replication scopes.
A move is not one bulk copy: three planes move in bulk, storage, data and messaging , while five carry as metadata with their foreign keys remapped, so what points at the workspace is repointed rather than orphaned.
Across an organization boundary, the same move earns a trust overlay
Relocating to another organization is mechanically the same cross-node move, with a set of gates layered on that a same-org move does not need. Build the mover once; gate and transform at the boundary, never fork a second, less-tested cross-org path.
Consent, not a quiet copy
A regular workspace needs its owning organization's authorization; a clean room needs every collaborating organization to consent, all of them, not a majority. Nothing crosses the boundary before the consent is recorded.
Resealed under the destination's key
Data is decrypted and resealed under the destination organization's key, and the raw key never crosses the cell boundary. Secrets and credentials are deliberately withheld and re-provisioned at the target rather than carried across a trust boundary.
Residency, checked before a byte moves
A residency gate confirms the destination cells may hold the data under its constraint, and a default-deny egress review runs per reference class, so a relocation that would violate residency is refused before it starts, not discovered after.
Identity references, repointed or dropped
Every cross-cutting reference that points at the workspace (owner, home placement, inbox, grants, federated identity) is enumerated in a total, fail-closed matrix and repointed, remapped or dropped. Cross-org trust that has no path is dropped, not smuggled across.
The category, reframed
A data platform treats a workspace as a fixed address in one region of one cloud. Treat it instead as a movable object with a stable identity, and a whole class of operations that used to be migration projects, succession, relocation, disaster recovery, partner hand-off, become operations on the same plane.
Identity-preserving relocation that keeps an inbox and feed, consent-gated and resealed relocation across an organization boundary, a failback-able move inside a fenced rollback window (and all of it available where there is no cloud at all) is the category this plane is built to own. It is a claim about mechanism you can walk end to end, not a grade we award ourselves.