IAM

You can invite/manage users and configure API/CLI access through app settings within a specific workspace.

User

You can invite and manage users for a workspace.

App

You can create and manage apps for issuing Client Secrets for API/CLI access to a workspace.