'%20filter='url(%23b)'%20transform='translate(0%20-286)'/%3e%3cpath%20d='M1636.5%20147c-123.436%200-223.5%20102.975-223.5%20230s100.064%20230%20223.5%20230S1860%20504.025%201860%20377c-.143-126.964-100.124-229.853-223.5-230Zm107.16%20308.341c-1.892%202.323-4.973%203.231-7.78%202.295l-98.896-32.908-98.896%2032.908c-2.807.933-5.884.022-7.774-2.3-1.89-2.32-2.212-5.587-.815-8.25l101.128-192.49c1.376-2.238%203.776-3.596%206.357-3.596%202.58%200%204.981%201.358%206.357%203.596l101.128%20192.49c1.401%202.663%201.08%205.932-.81%208.255Z'%20fill='url(%23c)'%20filter='url(%23d)'%20transform='translate(0%20-286)'/%3e%3c/g%3e%3c/svg%3e)
Tenancy and scope
This page is the mental map for every other guide. Loopback is built as nested scopes. Permissions, billing, DNS, networking, and compute all inherit from that shape.
The four layers
Account
A person (or tightly scoped automation using account API keys). An account can join many organizations with different roles in each. The account is not where servers or clusters live.
Organization
The commercial and administrative tenant. It owns projects, domains, payment instruments, notification channels, network bridges between org networks, and the RBAC roles you define. Compliance reviews usually start here: data and invoices roll up to the organization.
Project
A governance boundary inside an organization. Every workspace belongs to exactly one project. Many teams use separate projects for production, staging, and internal tooling. Project-scoped resources (for example some load balancers, object stores, DNS zones, monitoring objects) are shared across workspaces in that project when you design them that way.
Workspace
The environment where hosts, agents, Kubernetes (when applicable), workspace-scoped load balancers, and workspace-scoped firewalls live. This is the level at which you typically order servers, open shell sessions, and download kubeconfig.
Why the split matters for buyers
- Isolation: Strong boundaries between organizations; configurable separation between projects and workspaces.
- Delegation: You can give a contractor project access without handing them the whole organization.
- Cost and audit: Line items and usage reports are aligned to organization and then allocated by project / workspace in reporting surfaces your operator exposes.
How this connects to networking
Networks are stored per organization but carry a context field: they can be tied to the whole organization, to a specific workspace, or to system scope in legacy flows. Bridges connect two networks within the same organization. Firewalls can be organization-wide or workspace-scoped, and hosts can attach additional firewall objects so effective policy is layered.
Read next: Networking overview, Firewalls.