Only Organization Administrators have access to create a Workspace. Once an Organization Administrator creates a Workspace, he/she automatically becomes the Workspace Administrator and has full access to everything under it. This ranges from creating Applications, managing access to those Applications through Domains and Roles.
It is possible to setup multiple users as Workspace Administrators for delegation, and as a minimum each Workspace should have at-least one administrator to run it effectively. You can remove Organization Administration from Workspace after adding additional users to Admin role, but that will have no impact on his super user access capacity and he can manage the Workspace anytime and override the other Workspace Administratior capacity.
At a very high level you can administer the Workspace using the tabs shown below:
Application: This tab shows the list of all Applications created under the Workspace and they can be accessed easily for further administration.
Access Control: This is where you create and manage Domains to limit the access you want to give to your users. You can setup access to all or a limited set of Applications and further decide what level of access they have inside each Application.
More details on administering Workspace are available here Workspace Administration
Go to the Next Article: Application