Requires the admin:workspace scope and a Workspace Admin+ role. name, description, conditions, and is_active can change independently; trigger_type, trigger_config, and steps must be supplied together. Campaign-managed workflows are read-only on this surface.