IAM
You can invite/manage users and configure API/CLI access through app settings within a specific workspace.
User
You can invite and manage users for a workspace.
App
You can create and manage apps for issuing Client Secrets for API/CLI access to a workspace.