Wow vr this was so incredibly helpful I cannot thank you enough!! This helped me really wrap my head around workspace versus account and does explain the discrepancies between the two, very confusing, especially for example when you add a group via ui in the workspace - its account level, but you can create a workspace level through api only. Bottom line, as you said the main source of truth is the account. Thank you!!