# Administration

Altertable accounts are split into organizations and environments. An organization is the company account: members, billing, and the environments you create. An environment is an isolated workspace for one stage of work, with its own cloud region, compute, catalogs, and analyses.

The core pieces are:

- **Organizations own the account**: Members, roles, billing, service accounts, and management API keys live on the organization. Create one organization per company or isolated tenant.
- **Environments isolate work**: Create an environment for each stage of your workflow (development, staging, production) or for a customer-specific boundary. Each environment has its own cloud provider, region, compute allocation, and lakehouse.

## Organization

An organization is the top-level account. It holds:

- Team members and invitations
- The plan, usage, and compute units you allocate to environments
- Service accounts and management API keys
- Organization-wide integrations and shared AI context

Organization roles control who can administer the account and whether someone can read or write data across every environment. Use [access control](/docs/administration/access-control.md) to assign organization, environment, and catalog roles.

Manage members, the plan, and environments from **Organization settings**.

## Environment

An environment is the workspace you open in the app. Data, queries, data apps, insights, tasks, and knowledge all live inside one environment.

Create a new environment when you need a separate stage or audience:

- **production**, **staging**, and **development** for the same product
- A dedicated environment for a customer or team that should not share catalogs

Each environment has:

- A slug used in app URLs and APIs (`/app/{organization}/{environment}`)
- A cloud provider and region for that environment's infrastructure
- Compute units allocated from the organization plan
- Its own catalogs, credentials, and analyses

Environment roles let people open one environment without granting access to the others. Catalog roles can narrow that further to a single data source.

## How they fit together

```text
Organization
  ├── Members, billing, service accounts
  └── Environments
        ├── production
        │     catalogs, compute, insights, tasks
        └── staging
              catalogs, compute, insights, tasks
```

Provision environments from Organization settings or with [Terraform](/docs/administration/infrastructure-as-code.md). Query and analyze inside an environment through the [lakehouse](/docs/lakehouse.md).

## Administration guides

- [Security and access](/docs/administration/security.md): Control access, identities, and encryption across Altertable organizations, environments, and catalogs.
- [Access control](/docs/administration/access-control.md): Manage organization, environment, and catalog access for team members, service accounts, and production vs staging workspaces.
- [Network](/docs/administration/network.md): How Altertable workers reach your catalogs. Allow these egress IP addresses, or connect through an SSH tunnel when the database is not publicly reachable.
- [Principals](/docs/administration/principals.md): Manage Altertable principals for people and automation so access to organizations, environments, and data stays governed.
- [Authentication](/docs/administration/lakehouse-credentials.md): Altertable generates secure credentials for each environment. Access them to connect via the HTTP API, Arrow Flight SQL, or Postgres adapter.
- [Encryption](/docs/administration/encryption.md): Encrypts data in transit and at rest, including credentials for databases and connected object storage buckets.
- [Limits](/docs/administration/limits.md): Altertable implements soft limits on storage, agents, and SQL sessions across pricing tiers, with hard limits for memory and large table scans.
- [Terraform](/docs/administration/infrastructure-as-code.md): Manage Altertable environments, buckets, catalogs, service accounts, members, credentials, and roles with the Terraform provider.