Environments & ecosystem
The structure underneath BrandLAB is the reason it can be trusted with more than one client, brand or department at a time. It is worth understanding before you configure anything.
The layers
The company. Billing, plan, entitlements, members and teams all attach here. One login can belong to several organisations — an agency and its own brand stay entirely separate, with separate everything.
A brand, client or business unit inside the organisation. Records, agents, assets and integrations belong to exactly one workspace, and nothing leaks sideways between them.
Groups of people inside the organisation. Structure for how you work — never a permission grant, so a team can only contain people who already have access.
Owner, Admin, Manager, Contributor, Viewer. Access is denied by default and granted down this chain; the requester of an approval can never be the one who approves it.
Bound to a workspace like a member of staff, governed by the same model as the humans. An agent can never reach data its operator could not.
Shapes
The layers stay the same. What changes is how many workspaces you run and where you put the approval gates.
One organisation, a workspace per client
Client data, agents and assets stay isolated by workspace while billing, seats and the credit pool stay central. An account manager sees their clients; a client never sees another.
A Content and Research agent per client workspace; one Operations agent across delivery.
One organisation, one workspace
The simplest shape. Everything in one place, with agents scoped to the whole business and permissions used to separate finance from marketing rather than data from data.
CMO, Content and Analytics to start; Sales once the pipeline justifies it.
One organisation, a workspace per brand
Each brand runs its own campaigns, tone and assets with its own agent memory, while the group sees consolidated cost and performance across all of them.
A CMO per brand, one group-level Analytics agent reading across workspaces it is granted.
Organisation with teams and strict approval levels
Departments become teams, spending and publishing sit behind level-three approval, and the audit trail answers who authorised what — the part procurement actually asks about.
Research and Analytics broadly; anything outbound gated on a named approver.
The ecosystem
BrandLAB is also infrastructure. Integrations expose their capabilities to the workforce, an agent store lets you install pre-built specialists that declare their permissions before you install them, and an API, webhooks and an MCP server let your own developers extend it.
Connected tools expose capabilities the workforce can call — under the same permissions and approval levels as anything else. Instagram is live; Google and Meta are next.
Install pre-built agents by category. Every listing declares its permission matrix and tools up front, and an install can never grant more than it declared.
Scoped API keys, signed webhooks and an MCP server, so your systems and your agents can reach BrandLAB with the same guarantees your staff have.
When AI genuinely cannot finish something, the agent posts it to a specialist, and the workflow resumes when the human delivers.
Ask for the week's performance and act on it out loud. Voice inherits the same permissions and approval gates as every other route in.
Existing automations become something agents can trigger, so scheduled work and agent work are one system rather than two.
