Core concepts
The shared model behind the dashboard, providers, and MCP tools.
- Documentation owner:
- BlendDuck Documentation
- Last reviewed:
Workspace
A workspace is the authorization boundary for a brand or operating team. Users, connected channels, knowledge, posts, schedules, billing, and MCP tool calls are all evaluated in workspace scope.
There is no implicit “first workspace” fallback. Any external operation that targets workspace data must identify the workspace and pass membership checks.
Channel
A channel is one connected social account. It records the provider identity, granted capabilities, encrypted credentials, token health, and publishing configuration.
Post
A post is one logical composition. Its post_target rows carry independent
channel content, settings, schedule, media references, external identity, and
delivery state. A single composition can therefore finish as published,
partial, failed, or cancelled without losing the result of another target.
Provider
Each provider owns authorization, token exchange and refresh, account discovery, validation, media behavior, and publishing. Unsupported actions fail explicitly rather than falling back to another platform's rules.
The shared capability registry describes connection, refresh, publishing, Analytics, and Inbox support, including required scopes and review or partner access gates. Product surfaces and workers consult this same registry before calling a provider.
Application use case
Dashboard requests, REST handlers, MCP tools, OAuth callbacks, and jobs enter through the same typed application use cases. Transport adapters parse requests and map responses; authorization, tenant checks, idempotency, provider gates, and business workflows remain in the application layer.
Every business write records an immutable command audit with workspace, actor, source, request identity, versioned operation, outcome, and a sanitized result. Workspace owners and admins can inspect only their own workspace history.
Permission boundary
Dashboard users authenticate with Better Auth. MCP clients obtain OAuth access tokens with explicit read or write scopes. Social-provider access tokens remain encrypted on the BlendDuck server and are never returned to MCP clients.