Workspaces
A workspace is where an agent actually does its work. Understanding workspaces is the key to understanding OpenFlows' security model, because nearly everything that makes the system safe comes from how workspaces are built and isolated.
Each agent runs in its own short-lived, disposable workspace. It is the "execution seat" for one agent on one ticket: it is created when work on a ticket begins, and it is torn down when the work is done.
A worker workspace is deliberately thin
A worker workspace is kept small on purpose. It contains only what the agent needs to do its job.
| A worker workspace contains | What it is for |
|---|---|
| The coordination surface | How the agent talks to the rest of the team. |
| The repository checkout | The code on the branch the agent is working on. |
| Role skills and standards | The role's skills, standards, and persona. |
And, critically, it contains none of the following:
| Never in a worker workspace | How it is handled instead |
|---|---|
| LLM API keys | Every AI call is routed centrally through the model gateway in the control plane. |
| Raw repository credentials | Git identity flows through a scoped OAuth link, not a shared token. |
| Agent frameworks | The intelligence runs centrally; the workspace only hosts the coordination surface. |
No secrets in worker workspaces
Workspaces are isolated from each other
Every agent works in its own isolated environment. The reviewer and the builder never share a filesystem: the reviewer cannot reach into the builder's tree, and can only request that the builder run a safe command and send evidence back. This physical separation is what makes adversarial review trustworthy - a reviewer cannot be fooled or coerced by inspecting or editing the work it is meant to judge.
Network access is tight
A worker workspace can reach only what it needs:
- The control plane, for coordination and model-backed work.
- GitHub, to push, pull, and manage pull requests.
- The coordination store.
- The internal relay used for delegated verification.
Everything else is denied. Combined with the absence of keys, this dramatically shrinks the surface an attacker - or a misbehaving agent - could exploit.
Nobody is anonymous
Every action an agent takes inherits a real identity. There are no shared, mysterious accounts. When something is merged or commented on, it is attributable to the tenant's identity, and the trail is auditable.
The orchestrator is different
One workspace is long-lived rather than disposable: the orchestrator workspace. This is the trusted "brain" that runs the control loop and hosts the coordination relay. It is the one place that legitimately holds the credentials the workers never see. The asymmetry is deliberate:
- The trusted, long-lived component does the coordination.
- The untrusted, disposable components do the work.