EPIC — Team Workspaces

OUTCOME (not a feature list)
A user can put work in a shared space and control who sees it. Success:
40% of active accounts have ≥2 members within 60 days of ship.

THE DECISION THAT GATES EVERYTHING
Is a workspace a tenant or a container? Tenant means row-level isolation
and it touches every query you have. Container means a foreign key and a
filter. This decision cannot be deferred — every story below inherits it,
and reversing it later is a migration, not a refactor.
  → Recommend: container now, tenancy boundary designed but not built.

SLICES — each independently shippable
  S1  Data model + backfill        [gated by the decision above]
      Every existing resource gets a workspace. Solo users get a
      personal workspace silently. Ships dark.
  S2  Create + switch              First user-visible slice
  S3  Invite + accept              Email, token, expiry
  S4  Roles: owner / member        Two roles only. Not four.
  S5  Workspace-scoped listing     Every index endpoint gets the filter
  S6  Billing per workspace        ← often forgotten until it blocks launch

DEPENDENCIES
  S1 → everything. S3 → S2. S6 → S4. S5 can run parallel to S3–S4.

EXPLICITLY OUT
  Nested workspaces · cross-workspace sharing · custom roles · SSO
  provisioning. Named here so they get deferred deliberately rather than
  discovered mid-sprint.

RISK
  S1's backfill is the only irreversible step. Rehearse against a
  production-sized copy before running it, and make it resumable.

OPEN QUESTION FOR PRODUCT
  What happens to a solo user's existing content on their first invite —
  does it move into the shared space or stay personal? This changes S1.