Set a workspace preference. `scope: "workspace"` with no `namespace` sets the workspace-wide default, which only a workspace owner or admin can set; a namespaced workspace value is open to any member. `scope: "member"` sets the CALLER's own override for themselves; only an owner or admin can pass `member_id` to set another member's `action_trust` level.
Known keys: invoice_default_layout, invoice_design, action_trust, preferred_name, form_of_address, mail_sender_choice, timezone, bank_account_offer, invoice_payment_account, payment_link_reconnect_offer, sunday_routines, customer_facts_note_id. An unrecognized key is refused, never silently accepted.
- `action_trust`: how far Well may act alone for one kind of action. The namespace is the kind code (for example `send_in_name`, `change_record`) and the value is `confirm` or `act_alone`. Over this MCP server a level can be lowered to `confirm` but never raised to `act_alone`: the person raises it in Well's own chat. A purchase on a website is the one payment with a level (`browser_purchase`); every other payment, bank detail changes and password changes always ask and have no level.
- `invoice_default_layout`: the workspace's house invoice design, one of the layouts the invoice-design card offers.
- `invoice_design`: the invoice design options object the invoice-design card hands you: `{ layout, theme, locale, payment_terms_note_id, tax_rate_id, legal_mentions_note_id, payment_means_id }`, each optional, ids as uuid or null. It is the exact object `well_generate_document` takes as `design`, so store it with those keys. Never store the `design_*` attributes: that spelling belongs only to `well_update_invoice_design`, and is converted to (`layout` → `design_layout`, `payment_means_id` → `design_payment_means_id`, …) only when calling that tool.
- `preferred_name`: the name the person chose to be called by, as text (e.g. "Max"). It belongs to that person alone: save it with `scope: "member"` and no `namespace`; any other scope or namespace is refused.
- `timezone`: the person's own IANA time zone name (e.g. "Europe/Paris"), used to read the times they say. It belongs to that person alone: save it with `scope: "member"` and no `namespace`; any other scope or namespace is refused.
- `form_of_address`: the register Well writes to the person in, `informal` or `formal`, for a language that separates two (French "tu" or "vous"). It belongs to that person alone, like `preferred_name`: `scope: "member"` and no `namespace`.
- `mail_sender_choice`: the caller's private choice for one mail sender. Save it only with `scope: "member"`; the workspace scope and a `member_id` that names another member are refused. The `namespace` is the `namespace` that `well_list_mail_senders` returns for that sender (`sender:` and a 40-character hash of the address): pass it back unchanged and never compute it. The value is `{ "choice": "keep" | "skip" | "unsubscribe", "sender": "<address>" }`, and `sender` is the address that namespace was made from.
- `bank_account_offer`: where the one offer to add a bank account the invoices print stands for the caller: `offered` when the offer is made, then `declined` or `added` with the person's answer. It belongs to that person alone: save it with `scope: "member"` and no `namespace`. Any saved value means the offer is never made again.
- `invoice_payment_account`: the account the workspace marks as primary, which an invoice prints when no earlier invoice of the issuing company printed one of its own accounts. The value is `{ "payment_means_id": "<uuid>" }`, the id of one payment means of the workspace's own company, never an account of another company or of a person. Save it only with `scope: "workspace"` and no `namespace`, when the person asks in words for that account by default; only a workspace owner or admin can set it.
- `payment_link_reconnect_offer`: where the one offer to reconnect the provider that makes payment links (Stripe or Qonto) stands for the caller: `offered` when the offer is made, then `declined` when the person says no. It belongs to that person alone: save it with `scope: "member"` and no `namespace`. Any saved value means the offer is never made again.
- `sunday_routines`: whether the caller's routines (the morning brief, routine reports and reminders) run on Sunday in their own time zone. By default they do not, unless a business meeting is on the caller's calendar that Sunday or the caller often writes to Well on Sundays. Save `receive`, the only value, when the person asks to get them on Sunday too, from now on. Save nothing for one Sunday only ("not this Sunday", "skip the brief tomorrow"): this key is permanent. It belongs to that person alone: save it with `scope: "member"` and no `namespace`. For one routine on Sunday only, name Sunday in that routine's rhythm instead. When the person asks never to get anything on Sunday, even when they have meetings, save nothing: say that Sundays are already held back by default, and that only a business meeting on their calendar that Sunday, an explicit ask or a habit of writing to Well on Sundays lifts it.
- `customer_facts_note_id`: the one note whose text Well may tell the shop's customers when it answers them on the shop's own WhatsApp Business number (hours, prices, stock, delivery rules). Well tells them nothing else from the workspace. The value is the `note_id` of one shared note written in Well: a private note, a note synced from another tool (Notion, Drive and similar), a deleted note or a note of another workspace is refused. Save it only with `scope: "workspace"` and no `namespace`, when the person names that note as what customers may be told; only a workspace owner or admin can set it. To stop customer answers, delete the key with `well_delete_preference`. The facts stay in the note: a change to the note reaches the next customer answer, so never save the facts themselves here.
`namespace` keeps a separate value of the same key per subject. To save a design for one customer, set `namespace: "customer:<id>"`, where <id> is the customer's company_id or person_id, and read it back with the same namespace. Omit `namespace` for the value that applies to no particular subject. A namespaced value never falls back to the un-namespaced one.
`scope: "member"` requires a caller with a resolvable person identity in this workspace. A caller with no person attached (an API key) can set only a namespaced workspace value: a member override or the workspace-wide default fails closed rather than falling back to another scope.
The result includes `previous_value`: the value that sat at this exact (workspace, scope, namespace) row immediately before this write, or `null` if this is the first write to that row. Use it to revert a change the user asks to undo, without a separate read.
