Workspaces
Sign in to work with your agents. Every action is attributed to you and recorded.
Available capabilities
Choose a capability to fill in a task, then review it before starting.
Agent execution access
Workspace access and agent execution are authorized separately. Connect execution access in Identity; your task draft stays in this tab.
Workspaces
Configured environments. Readiness describes configuration; deployment cards show where work is running.
Deployments
An online deployment can be idle. Active and queued task counts are reported separately from host health. Unknown means the host could not be reached.
Deploy a workspace
Choose a configured workspace and enrolled online host. Deployment needs explicit permission and recent passkey verification. Nothing starts until you review and submit.
Execution hosts
Hosts run approved Harness containers. Enrollment does not grant arbitrary Docker, SSH, command or mount access.
Enroll an execution host
Use an endpoint approved by the operator and its protected enrollment token. The token is write-only and is cleared after submission or leaving this view.
Deployment details
Review deployment action
The revision shown is checked again by the server. Stopping, updating or removing busy work is refused; drain and wait for active work to finish.
Application access required
You are signed in. A Workspace administrator must assign your application role before you can use this application.
Share your Identity Account ID with your Workspace administrator. Consent and organization membership do not assign application access.
Application roles set the actions an identity may perform. Workspace membership determines which workspaces they can access. Organization roles and consent do not assign these roles.
- Viewer
- Read assigned workspaces and deployment activity.
- Operator
- Also run agents, review approvals and deploy reviewed configurations.
- Administrator
- Also configure assigned workspaces, manage application access and enroll execution hosts.
Application roles apply across an identity's personal and organization contexts. Current organization membership, workspace membership, consent, governance and approval checks still apply.
Assign application access
A recent passkey verification is required. Changes apply to subsequent requests and runtime dispatch; an effect already sent to an external system may finish.
Verify identity with a passkeyAccess activity
The latest 100 access changes are shown from the append-only audit chain.
Agents
Select an agent. Each has its own model, instructions and governed tools.
Add an agent
Import a workspace blueprint
A blueprint defines the workspace, agent templates, governance and capabilities. Upload its JSON document and any referenced Markdown files, validate the complete bundle, then review the exact configuration before creating a workspace.
Keep your original files. Uploaded material stays in this tab and in a private, expiring server plan; it is never saved in browser storage. Instructions and Markdown must contain no secret values.
Review the workspace
Review the normalized configuration, templates and exact versions, instructions, governance, tool/target policies, model choices, memory and disabled automation. Importing grants no memberships, credentials, approvals or running jobs.
Resources & Connections
Connect the resources this workspace needs, choose permitted credential references, then verify and review activation. No secret values are entered here. Connecting an account opens a new tab and preserves this setup draft.
Agent readiness
Installation bindings
Choose from resources currently permitted for this identity. Credential choices identify existing vault entries or operator-approved references; they never disclose a key.
Verify and activate
Verification checks current configuration, authorization and permitted references. It does not send a model request or prove that a provider key works. Activation starts no tasks or schedules.
Review activation configuration
Recent work
Review the exact proposed action
Approval permits this proposal only. Verify the target, arguments and observed state before continuing. Recent sign-in is required.
Verify approval accessEvidence and operation results
Pinned run configuration and governance
Memory used
The memories and conversation continuity supplied to this task, subject to current access and retention.
Stop automatic recall of this conversation and personal memories derived from it. Original task records, audit history and backups remain subject to their separate retention. Manage deliberately shared memories separately in Memory.
Agent configuration
Choose this agent's model and operating limits. Published master governance can narrow these settings.
Pinned agent template
Review a published template version
Adoption is explicit. Instance overrides remain in place, master governance still applies, and existing tasks retain their pinned version.
Agent templates
Templates belong to this workspace. Drafts are immutable versions; publishing makes a reviewed version available for new agents. Existing agents adopt updates only when their owner explicitly chooses a version.
Import a template
Packages and imported JSON create a local draft. Review its instructions, tools and policy, then publish explicitly. Imports do not grant tool access or include model credentials.
Create template draft
Master workspace
A master workspace owns its agent instances, shared artifacts, governance and history. Credential vault access is managed separately in your identity service.
Workspace members
Membership allows access to this master workspace. Each person keeps their assigned application role and identity-owned credentials. Invite them through your identity service first, then use their stable identity ID.
Effective governance
Published master rules and agent rules apply together. Agent rules cannot widen inherited permissions. Current access is checked before each dispatch. Inspect the guidance sources and assembled instructions below; existing tasks retain their pinned instructions.
Harness inspection
Inspect configured controls, recorded validation and observations from your selected task. These are separate kinds of evidence.
Draft and publish governance
Governance versions
Files and artifacts
Files belong to this agent's workspace. Shared artifacts require explicit governance permission. Host filesystem paths are never selectable here.
Create or edit a text file
Tools
Connect systems, review their available actions, and explicitly assign tools in workspace and agent policies. Connecting a system does not grant an agent access.
Add connection
Review the endpoint, credential reference, target and every action contract. Discovery is untrusted input. Never paste secret values into this form.
Available actions
Tool names are namespaced. Enabled connections still require explicit policy grants and current authorization at dispatch.
Memory
Keep useful preferences, decisions and lessons across conversations. Personal memories stay private to you; shared memories are deliberately approved for this workspace. Memory is evidence, never permission to act.
Remember something
Save an explicit memory or correct an existing one. Agent suggestions remain personal until you confirm them. Never store passwords or API keys here.
Memory settings and inherited limits
Master settings set the ceiling. Agent settings can narrow it. Published governance and current access still apply at every model call. Only the workspace owner can change settings.
Workspace configuration history
Workspace configuration and deployment execution have separate audit ledgers, signing keys and exports. Select one source below. Sensitive values are excluded; independently retain exports and signing-key identities.
Background authorizations
Authorize bounded work for this agent beyond your browser session. Authorizations expire, can be revoked, and cannot approve sensitive actions on your behalf.
Authorize background work
Scheduled monitoring
Run a bounded task at a fixed interval. A schedule never overlaps its previous run and ends when its authorization or schedule expires.