Organisation

A team or customer on a Kodela host. Each organisation has its own network, its own members and its own settings; its workspaces cannot reach another organisation's. Public pages say organisation; the command line says --tenant.

An operator runs the host. Inside an organisation there are four roles: Owner, Admin, Member and Auditor, and the auditor is strictly read-only. Accounts are invite-only; an invitation lasts 7 days. Sign-in is a password, or per-organisation SSO with Microsoft Entra ID, Google Workspace or a generic OIDC provider.

SSO has not been exchanged with a real identity provider on record, only tested against a stand-in. There is no SAML, no SCIM and no native MFA. An organisation cannot be deleted yet. Administration

Workspace

An isolated container for one developer or one agent, on your host. It runs as a non-root user with no sudo and keeps a persistent home volume. Inside: a terminal with as many shells as you need, VS Code in the browser, app preview, and a headless browser on demand that obeys the same egress rules. Each workspace joins its organisation's network, and creation is refused unless the firewall has verified that network.

Workspaces run on your Kodela host. If a platform operator grants it and your organisation turns it on, a member's own computer can host their workspaces too. There, internet access is observed, not enforced; DNS filtering is not enforced; the source on its disk is readable by whoever uses it; and Docker is not available. Tested end to end only on Windows (Linux laptops up to enrolment; Mac only in a simulation).

Defaults: 2 GB of memory, 2 CPUs and 512 processes. An idle workspace suspends after 30 minutes and keeps its volume.

Container hardening is partial. There is no cap-drop, read-only root, custom seccomp profile or user-namespace remapping yet. Workspaces

Agent

An AI coding agent: the console chat, or Claude Code, Codex or Antigravity in the workspace terminal. Two settings shape it.

Agent profile: How much it asks first: Supervised, Assisted (the default) or Autonomous. Set per member, falling back to the organisation, then the platform. Push and pull requests are off in every profile until enabled.
Mode: What the chat may do in this turn: Ask and Plan are read-only; Build can write, run, propose and use checks; Run & Debug can write, run and use checks; Review & Test can use checks only. An unknown mode fails closed.

“Autonomous” is only a name. Every profile still sits under the organisation's policy and the approval layer. AI agents

Policy

Settings live at scopes: platform, organisation, member and workspace. The strictest value across the scopes wins, so an organisation can tighten what the host allows and never loosen it. An allowlist works the same way: an organisation's list is added to the host's and cannot remove from it.

The security level is the posture per scope: Open, Metered, Guarded (the default) or Strict. Under Guarded and Strict, git and model credentials stay on the host behind brokers.

Under Open or Metered, tokens are mounted in the container. Egress ships in observe, which logs and allows. Governance · Settings keys

Execution

What turns an agent's proposal into a real action, and who says yes.

Approval card: Commands and writes outside the project end the turn “awaiting approval”; Approve resumes it. A parked write is shown as not written. Self-approval is the default; second-person approval is available per organisation.
Trusted checks: Checks an organisation lists run without a card, with no network, and are audited. The list starts empty.
Governed runs: Background agent runs, which need a grant for the organisation. The grant is tied to the commit it was proven on and lapses on every new one.
Validation gate: A push needs a passing verdict for its exact commit. Off by default.

Governed runs are measured with Claude Code only, and the validation gate has not yet been seen on a real GitHub push. Grant governed runs

Worker

An optional second host. It enrols over mTLS with a one-time token, is reached through a reverse-SSH worker tunnel, and takes placements from a Postgres-backed service on the first host.

Built, off by default, and seen only in development. One host is the supported shape today, and there is no high availability. A member's own computer hosting their workspaces is a separate, off-by-default feature, not a worker. Self-hosted deployment

Audit

An append-only record in eight streams, each a SHA-256 hash chain. bin/audit-log verify names the stream and line of any break. Credentials are redacted before writing. Exports: CEF, LEEF, RFC 5424 syslog, JSON and CSV. Retention is 90 days by default, and an organisation can only raise it. Every allowed push adds an authorship record: agent, human-console or unattributed.

Not protected against host root, and nothing ships off the box until you export it. Audit & evidence

And one more: brokers

A broker is a host service that holds a credential and acts for the workspace, so the container never holds it. The git broker pushes with short-lived GitHub App tokens and knows which workspace is calling from its socket. The model proxy keeps the real Anthropic credential on the host and gives each workspace a key worthless anywhere else. The key broker does the same for other providers, and the portal broker carries the workspace-to-console channel.

The key broker is off by default, and some AI APIs can still be reached directly from a workspace. See the known gaps.

Glossary

Operator: Whoever runs the host: the admin of the whole platform.
Front door: The authenticating entrance for all workspace traffic.
Egress: Outbound traffic from a workspace. It has one way out: the proxy.
Observe · Deny: The two egress modes. Observe decides and logs; deny enforces. There is no “enforce” mode.
Strictest wins: The rule every setting resolves by.
Authorship record: The per-push label: agent, console or unattributed.
Evidence report: What bin/compliance-report prints. It is not a certification.
Known gaps: The published list of paths Kodela does not close yet.

What these words do not promise

Isolation is per organisation network and per container, not a virtual machine. The host is the trust anchor: whoever holds root or the docker group holds everything.
Egress starts in observe. The words above describe controls; several are off until an admin turns them on.
One host. Worker hosts exist in code and are off by default. Members' own computers can host workspaces only if an operator grants it and the organisation turns it on, and there egress is observed, not enforced.

See the wiring Your first host

Verified against the main branch, 4 Oct 2026.

Seven words