How installation normally works
What a forward deployed engineer does by hand today.
An OAuth redirect. The customer chooses the workspace and approves, and the authorization carries actor=app so anything created afterwards is attributed to the vendor's application rather than to the admin who clicked Approve.