Trickest is a security-automation platform where a workflow can actively scan a client’s production systems. So who can touch what isn’t a nicety — it’s the deal. When I picked it up, access was just two org-wide buckets, admin and member: a member saw everything, an admin controlled everything.

Fixing that needed a unit to scope access to — a workspace. But introducing workspaces had a second, unavoidable consequence: the product’s flat-list navigation had no way to express which workspace you were in, or to separate account-wide pages from workspace-scoped ones.

Two ideas make access tractable. First, the thing access is scoped to: a workspace — a group of workflows (a red-team engagement, a client project) that people navigate into from the switcher up top.

Instead of one org-wide label, everyone gets a role inside each workspace — and that role can be granted to a single person or a whole team. So access became two levels: a light org role, and a per-workspace role.

Second, the roles themselves. Per-user permission toggles, or a small set of named roles? I tested both against one task — “give a contractor execute access to one workspace”.

Toggles fail the predictability test — thousands of states, and “can Jonas execute in Red Team?” needs a whole panel to answer. Roles win: a strict ladder that maps cleanly onto the people who actually use the product.

The access lifecycle is one flow: invite → organize into teams → grant workspace access → maintain.

The invite is deliberately thin — just emails. Placement happens next, where you can see the whole person.

Teams group people so access scales: members on one side, workspace access on the other. Grant a workspace to the team once and every member inherits it.

Granting a workspace — to a person or a whole team — is a single pick-and-role step, using the same five-role ladder, with a running summary (Read → Blue Team) so the outcome is legible before you commit.

The person view closes the loop: every workspace someone can touch, direct or inherited from a team, in one panel. Onboarding is one pass; offboarding is one screen, not a hunt through every workspace.

Workspaces solved scoping — but the moment they existed, the flat sidebar broke. Pages now split into global pages that belong to the whole account (library, billing, account settings) and workspace-scoped pages that only make sense inside one workspace (its workflows, runs, variables). Navigation had to answer three questions at once: which context am I in, how do I switch workspaces, and how do I move between global and workspace-scoped pages — without turning the sidebar into a maze. I ran at it three times.

Iteration 1 — Bundled flyout. One popover that combined current-workspace nav, the workspace switcher list, and global nav items in a single menu.

Iteration 2 — Persistent sidebar with switcher header. Keep the nav items always visible; condense the switcher into a single header row at the top.

Iteration 3 — Icon rail + drill-in panel. A thin icon-only rail on the far left, opening a drill-in panel with a breadcrumb and grouped categories.

The resolved model is one sidebar with two layers. The root layer is workspace-first: a switcher at the top (context always visible, changeable in one click), the four workspace pages as a flat labelled list, and below a divider the three drill-in categories — Global, Library, Settings.

Drilling into a category doesn’t open a second panel or an icon rail — the same sidebar slides to its second layer: workspace items give way to the category’s grouped items, with a back row (labelled with the category name) to return. One place to look, two levels deep, never both at once.

In context — the root layer inside a workspace, product-dark like the real app:

The three states of the same sidebar, side by side:

And the mechanic in motion — the same panel opening the switcher, then sliding into Settings and back:

Figures below are illustrative — the mechanism and direction are real; the exact numbers are reconstructed, not measured.

Access & teams

• Onboarding collapsed to one pass — a new contractor went from a ~9-step, multi-screen setup to a single invite-and-assign flow.
• Offboarding became one screen — instead of hunting through 12+ workspaces to revoke access, everything a person can touch is revoked from one panel.
• Enterprise deals unblocked — least-privilege went from a standing security-review blocker to a checkbox: 4 of 6 reviews that previously flagged access passed in the two quarters after launch.

Navigation

• Switching context dropped to one click — the persistent switcher pill replaced a reopen-the-menu loop, cutting workspace changes from ~3 interactions to 1.
• “Where am I” stopped being a question — with the pill always showing the active workspace and a clear global/scoped split, mis-navigation into the wrong workspace fell sharply in usability sessions (roughly 4 in 5 wrong-context slips disappeared).
• The sidebar scaled with the product — new global pages have an obvious home in the Global section instead of lengthening one flat list.

What I’d change: design the audit view earlier (“who had access last quarter?” showed up within weeks), check hidden-vs-disabled against the API — a Write user briefly saw a delete control the server correctly refused — and re-test icon-rail density at higher workspace counts, where the switcher list gets long and the iteration-3 rail idea might earn its place back as a secondary index.