One workspace per agency. Each client is a workspace inside it, so a connection you authorise once is not re-authorised per run.