The problem

We're a 150+ person engineering org and want to use Railway as a self-service deployment platform for everyone. Today, all workspace members can see and modify every project in the workspace.

The only existing workaround is splitting the org across multiple workspaces. That's cumbersome at our scale, breaks under a single subscription/plan (each workspace has its own billing, no umbrella concept)

It also creates a UX/safety concern: with 150+ people in one workspace, the canvas is cluttered with projects no one on a given team owns, and anyone with workspace-level permissions implicitly inherits access to projects they have no business touching. It's analogous to giving everyone in a GitHub org write access to every repo by default.

What we'd like

A team concept within a workspace, where workspace members belong to teams, and only see/access projects belonging to their teams.

If a user doesn't belong to a team, they can still deploy a project, but not see other projects.

Admins can create teams, assign users to them, and move orphan projects to existing teams, or move projects from one team to another.

Simpler alternative

A simpler alternative that would also solve most of our pain: add a new visibility called e.g. workspace private, actually scoped to project members, and allow workspace admins to set the default visibility for new projects.