Skip to Content
Getting StartedConceptsEnvironments

Environments

Morse AI organizes your data in exactly three levels: Organization → Workspace → Environment. Understanding what each level does — and, importantly, what it does not do — is the difference between reading your dashboards correctly and being confused by them.

The three levels

  • Organization is the account and the only access boundary. Every member of an org sees the same agents and traces. Billing, roles, and data isolation all live here.
  • Workspace is an organizational container inside an org — a way to group work. It does not gate access: two members in different workspaces of the same org still see the same org-scoped data.
  • Environment is a deployment lane inside a workspace (think production, staging) and the API-key boundary. It is a data dimension, not an access boundary.

Each level chains to exactly one parent: a workspace’s slug is unique within its org, an environment’s name is unique within its workspace.

An environment is a read-path filter, not a separate store

This is the concept that trips people up. An environment doesn’t hold its own copy of your data. When you filter a view by environment, Morse AI composes that filter with your org scope — it narrows what you already have access to; it never grants or replaces access.

Which environment a trace belongs to is resolved from the API key that sent it — never from your application code, a payload field, or user input. So in the UI, environment shows up as a filter pill you toggle, not as a workspace you switch into. An environment id from another org is treated as if it doesn’t exist (a 404), so the filter can never leak across the isolation boundary.

One environment, one API key — with a rotation grace window

Each environment has exactly one active API key at a time — enforced in the database, not just the UI.

When you rotate a key, the old one doesn’t die instantly. It enters a 24-hour grace window: the new key is active immediately, and the old key keeps authenticating for 24 hours so in-flight deployments don’t break mid-rollout. After that instant, the old key is treated as revoked.

If a key is compromised, you can rotate with no grace — the old key is revoked immediately. You manage all of this on the Workspace settings screen, under Environments & API Keys; the raw key is shown once, at creation, and never again.

Last updated on
LifecycleDashboard