One set of permissions, in detail
You decide what AI may see and do
Identity, permissions, keys, execution records, approvals and handover are configured in one place. Before deployment we agree the data boundary, how long records are kept and which systems are connected.
- One identity Employees enter through the platform account, and usage is attached to the actual user, project and resource.
- Layered access Models, tools, files and permitted actions are controlled by role, project and workspace.
- Central key custody Model providers and CLI credentials are configured and distributed centrally instead of living in personal environments.
- Execution records AI conversations remain attached to the user, workspace, project, runtime and model, with status and usage available for review.
- Requests and approval Workspaces, resources and capabilities are granted through an approval flow that leaves a record.
- Handover and takeover A workspace belongs to the project, not the person. When someone leaves or a project changes hands, an administrator takes the workspace over from the console. Sessions, files and execution records are retained, and no personal device has to be recovered.
- What may leave Whether project files can be downloaded to an employee's own machine is an administrative setting, not an open default.
- A single egress Calls to external models leave through a fixed egress over an encrypted tunnel, so the outbound identity stays stable and auditable rather than varying with each employee's network.
- Deployment choice Where data may not leave the organization, private or hybrid deployment defines the boundary.
Agree these before deployment
- How long records are kept, who may read them and which fields are masked are your settings, not platform defaults.
- Approval before a tool or command runs depends on whether the selected agent supports it.
- Where data may not leave the organisation, private or hybrid deployment defines the boundary.
Walk your boundary with us
Describe the data you must protect, the systems you need connected and the records you must keep, and we will map the permissions and deployment to match.