Set a workspace preference. scope: "workspace" with no namespace sets the workspace-wide default, which only a workspace owner or admin can set; a namespaced workspace value is open to any member. scope: "member" sets the CALLER's own override for themselves; only an owner or admin can pass member_id to set another member's action_trust level.

Known keys: invoice_default_layout, invoice_design, action_trust, preferred_name, form_of_address, mail_sender_choice, timezone, bank_account_offer, invoice_payment_account, payment_link_reconnect_offer, sunday_routines, customer_facts_note_id. An unrecognized key is refused, never silently accepted.

• action_trust: how far Well may act alone for one kind of action. The namespace is the kind code (for example send_in_name, change_record) and the value is confirm or act_alone. Over this MCP server a level can be lowered to confirm but never raised to act_alone: the person raises it in Well's own chat. Payments, bank detail changes and password changes always ask and have no level.

• invoice_default_layout: the workspace's house invoice design, one of the layouts the invoice-design card offers.

• invoice_design: the invoice design options object the invoice-design card hands you: { layout, theme, locale, payment_terms_note_id, tax_rate_id, legal_mentions_note_id, payment_means_id }, each optional, ids as uuid or null. It is the exact object well_generate_document takes as design, so store it with those keys. Never store the design_* attributes: that spelling belongs only to well_update_invoice_design, and is converted to (layout → design_layout, payment_means_id → design_payment_means_id, …) only when calling that tool.

• preferred_name: the name the person chose to be called by, as text (e.g. "Max"). It belongs to that person alone: save it with scope: "member" and no namespace; any other scope or namespace is refused.

• timezone: the person's own IANA time zone name (e.g. "Europe/Paris"), used to read the times they say. It belongs to that person alone: save it with scope: "member" and no namespace; any other scope or namespace is refused.

• form_of_address: the register Well writes to the person in, informal or formal, for a language that separates two (French "tu" or "vous"). It belongs to that person alone, like preferred_name: scope: "member" and no namespace.

• mail_sender_choice: the caller's private choice for one mail sender. Save it only with scope: "member"; the workspace scope and a member_id that names another member are refused. The namespace is the namespace that well_list_mail_senders returns for that sender (sender: and a 40-character hash of the address): pass it back unchanged and never compute it. The value is { "choice": "keep" | "skip" | "unsubscribe", "sender": "<address>" }, and sender is the address that namespace was made from.

• bank_account_offer: where the one offer to add a bank account the invoices print stands for the caller: offered when the offer is made, then declined or added with the person's answer. It belongs to that person alone: save it with scope: "member" and no namespace. Any saved value means the offer is never made again.

• invoice_payment_account: the account the workspace marks as primary, which an invoice prints when no earlier invoice of the issuing company printed one of its own accounts. The value is { "payment_means_id": "<uuid>" }, the id of one payment means of the workspace's own company, never an account of another company or of a person. Save it only with scope: "workspace" and no namespace, when the person asks in words for that account by default; only a workspace owner or admin can set it.

• payment_link_reconnect_offer: where the one offer to reconnect the provider that makes payment links (Stripe or Qonto) stands for the caller: offered when the offer is made, then declined when the person says no. It belongs to that person alone: save it with scope: "member" and no namespace. Any saved value means the offer is never made again.

• sunday_routines: whether the caller's routines (the morning brief, routine reports and reminders) run on Sunday in their own time zone. By default they do not, unless a business meeting is on the caller's calendar that Sunday or the caller often writes to Well on Sundays. Save receive, the only value, when the person asks to get them on Sunday too, from now on. Save nothing for one Sunday only ("not this Sunday", "skip the brief tomorrow"): this key is permanent. It belongs to that person alone: save it with scope: "member" and no namespace. For one routine on Sunday only, name Sunday in that routine's rhythm instead. When the person asks never to get anything on Sunday, even when they have meetings, save nothing: say that Sundays are already held back by default, and that only a business meeting on their calendar that Sunday, an explicit ask or a habit of writing to Well on Sundays lifts it.

• customer_facts_note_id: the one note whose text Well may tell the shop's customers when it answers them on the shop's own WhatsApp Business number (hours, prices, stock, delivery rules). Well tells them nothing else from the workspace. The value is the note_id of one shared note written in Well: a private note, a note synced from another tool (Notion, Drive and similar), a deleted note or a note of another workspace is refused. Save it only with scope: "workspace" and no namespace, when the person names that note as what customers may be told; only a workspace owner or admin can set it. To stop customer answers, delete the key with well_delete_preference. The facts stay in the note: a change to the note reaches the next customer answer, so never save the facts themselves here.

namespace keeps a separate value of the same key per subject. To save a design for one customer, set namespace: "customer:<id>", where is the customer's company_id or person_id, and read it back with the same namespace. Omit namespace for the value that applies to no particular subject. A namespaced value never falls back to the un-namespaced one.

scope: "member" requires a caller with a resolvable person identity in this workspace. A caller with no person attached (an API key) can set only a namespaced workspace value: a member override or the workspace-wide default fails closed rather than falling back to another scope.

The result includes previous_value: the value that sat at this exact (workspace, scope, namespace) row immediately before this write, or null if this is the first write to that row. Use it to revert a change the user asks to undo, without a separate read.