Settings

A workspace is the boundary everything in Tempio sits inside: connections, campaigns, drafts, media, plans, members and billing all belong to one, and nothing crosses between them. Settings is where that workspace, and you, are configured. It is twelve sections, and on any of them the sidebar turns into the settings column; members, invitations, billing and your own account used to live under /dashboard, and those addresses now send you here.

The settings column

On any settings page the sidebar becomes the settings column: a back row that returns you to the workspace, a search box, and the sections in two groups, Workspace and Personal. It is the one place the sections are listed: what is in it is what this workspace has. Search reads a section's name and its one-line description, and Escape clears it.

A section your plan does not carry is not in the column; what each plan carries is the billing page's to say, and the section's own address still opens and says so. A section that is somebody else's to change stays in the column marked View only, and Access, which a member cannot open at all, is marked Admins only; the page itself says whose the change is, rather than the section disappearing — the half that tells you what is happening is not the half that changes it.

General

The workspace's logo sits beside its name at the top of the sidebar; upload a PNG, JPEG or WebP up to 1 MB, or leave it and the workspace's initial stands in. The name is what everyone here sees, and the slug is what it is addressed by. Changing any of them changes nothing the workspace holds. The danger zone at the bottom holds the two ways out: leave, which takes you out and leaves the workspace standing, and delete, which takes the workspace and every connection, draft, plan and stored day of history in it. The last owner cannot leave — somebody has to be able to open the door.

Members

Every member with the role they hold, every invitation still waiting, and the seats your plan carries counted against both. Three roles, and a member can hold more than one.

Inviting somebody sends an email with a link; accepting it puts them in the workspace with the role the invitation named. An invitation that is waiting reserves a seat — otherwise five invitations on a three-seat plan would be a queue of surprises — and accepting one converts the seat that was already reserved rather than taking a second. The count is re-checked at the moment of acceptance, not only when the invitation was sent, because a plan can be downgraded while an invitation sits in somebody's inbox.

Billing

The plan this workspace is on, how much of this period's message allowance it has used, and the packs that top it up. A member sees the same page with no button to change the plan, and can still buy a pack, because the pool is shared. Billing is the page that explains what each plan carries.

Approvals

A rule names one connection or every connection in the workspace, and clears pauses, and budget or bid decreases under an amount it states in a currency it states. That is the whole of its reach. Everything a rule clears is still a draft on the record, and the row names the rule that cleared it — approved by you, or by a rule you wrote.

A chain is the other direction: one to four stages, each satisfied by a role, by named people, or by a client signing through a link, holding a change until every stage is signed. A change a chain matches is never cleared by a rule. Writing one is on the Scale plan and above. The same section carries the separation of duties switch, which stops the person who drafted a change approving it — off by default, owner only, and free on every plan.

Approvals covers all three; the values each platform reads off an ad account are Account defaults.

Guardrails

The caps a budget change is held to, at three scopes: the whole workspace, one connection, or one ad account. The most specific scope that sets a number wins, and it wins per number — a cap you leave empty falls through to the scope under it and finally to the account's own 28-day figure. Two checks are Tempio's and no override moves them: the 24-hour total of increases on a connection, and the kill switch. Editable guardrails come with Plus and up; below it the page shows the caps your accounts are held to and changes none of them. Guardrails covers what each cap does and what an override can say.

Access

A connection is reached by every member of the workspace until somebody restricts it. Restricted, it is reached only by the members named on it, each at a level — view, draft, or approve — and by every owner. A member who is not named does not see the connection refused: it behaves as though it were not there. It is absent from the dashboard and its figures, the campaign list, the drafts queue and every agent read, and naming it by id answers "not found", the sentence an id that never existed gets.

Approve on a restricted connection is the one place a level gives somebody more than their role does, which is what lets an account manager sign off their own client's changes without being made an admin of everybody else's. Access is the page for it, and it is owner or admin to open as well as to change: the page shows every restriction in the workspace at once.

MCP keys

A key is a credential for your own AI, bound to this workspace, carrying the scopes chosen when it was minted. The page also lists the connectors that have signed in over OAuth, with what each holds and when it was last used, and revokes either kind. MCP keys is the page for it.

Raw platform requests

Off by default. With it on, an agent holding a key for this workspace can read straight from Meta's, Google's or TikTok's own API — a field added last month, a resource Tempio never mapped. Every call is written to the audit log with its method, host, path and size; the response body is never stored there. Raw writes are a second switch inside the first, and a raw write is a change request no rule can clear: it waits for a person, with the sentence whoever drafted it wrote. This is the one setting an admin cannot change — it reaches past Tempio's own model to the platform's raw API, so it is the owner's. The escape hatch covers what it refuses.

Account

You, not the workspace: your name, your email and its verification, your password, passkeys, two-factor, and every device you are currently signed in on, each of which you can sign out from here.

Appearance

Light or dark, and your language, kept against your account. Appearance covers what each choice changes.

Affiliate

Yours too: the affiliate program, which pays you a share of what the workspaces you refer pay. It shows the same thing from every workspace you switch to, because an affiliate account belongs to a person. The Affiliate page covers applying, referrals, balances and payouts.

Per-connection controls

Some of what a workspace configures is not in Settings at all, because it belongs to one connection. On Connections:

• Pause a connection. Syncing stops and every apply written against it is blocked. This is the kill switch — the single control that stops Tempio writing to those accounts, whatever is queued and whatever rule would otherwise have cleared it. History already stored stays.
• Disconnect. The connection is switched off for good. Stored history stays in the workspace.
• Account defaults, per ad account, which change as drafts.
• A Restricted badge, on a connection only some members reach. Who those members are is set under Access.
• Reconnect, when a platform stops accepting the credentials Tempio holds.

Raw platform requests are the exception to the pattern: the switch is workspace-wide rather than per connection, and it reaches every connection at once. That is why it is the owner's alone.

Multiple workspaces

One account can belong to several workspaces, and how many you may own is a plan entitlement. The switcher is in the sidebar; everything on screen follows it, because every query is scoped to the active workspace rather than to your account. A new workspace starts empty — its own connections, its own drafts, its own keys — and nothing is shared with the one you came from, deliberately. That is the same boundary that keeps two clients' accounts apart.