Operating Properties#

Architectural properties customers should plan around.

  • Agents are owner- or sponsor-backed (current scope). This design covers agents that run in a managed workspace, are tied to a registered owner or sponsor, and operate under bounded, per-engagement authority. Pure service agents with no human principal, and broader agent-to-agent platforms, are future scope — adjacent patterns left for later, and noted where they would change the identity, delegation, authorization, or audit model.

  • Authority derives from a registered owner or sponsor. SSO-valid + portal-entitled + broker-current; no workspace-grants-access fallback. The agent operates with a policy-defined subset of the owner/sponsor’s permissions, bound by the per-engagement delegation record — never a separate authority. (For user-invoked agents the owner is the end user; for owner-backed service agents it is the registered sponsor.)

  • Bootstrap once per workspace before first terminal attach.

  • Access-broker sessions are short-lived and re-authenticated. Long-running flows rely on the workspace-side session multiplexer for persistence — the workspace keeps running while the user is offline. Workspace ≠ session (see Three Timescales of Sandbox Lifecycle).

  • Outbound is allowlisted, not generic. Broad public-internet reach belongs in a public data sandbox.

  • The workspace profile is fixed at provisioning. A profile is the provisioning-time definition of the workspace — base image and OS family, resource and GPU shape, network profile, and the policy bundle it binds to. Changing the profile requires reprovisioning. Day-to-day changes inside the workspace — installing packages, writing files in the agent home — are not profile changes; they live in the workspace’s mutable state and are reset on rebuild.

  • Single-tenant per workspace. Sharing happens through repos, tickets and chat — not by handing access to a workspace.

  • Workspace state is local and ephemeral relative to enterprise systems. Long-lived state belongs in upstream services (source control, object storage, ticketing). Push frequently so a rebuild is not destructive.

  • Consequential writes are human-reviewed, asynchronously. Agents read / search / summarize / draft — and write to personal or ephemeral targets (single-owner branches, scratch space, personal notes) — without review; writes to shared sources of truth (protected-branch merge, send, publish, delete, shared state change) require human approval. The gate is set by blast radius, not by the act of writing.