What do you want to do?

Create a workspace

1. Pick the organisation

   A workspace belongs to one organisation; that decides its network and its egress policy.

   ConsoleOrganisationsacmeWorkspaces

2. Name it and choose an owner

   The owner is the only member who can open it. Add the repository it works on, and turn on the browser IDE if they need it (about 1 GB of RAM more).

3. Or create it on the host

   on the hostCopy

   $ bin/workspace-agent create --tenant acme --workspace dev01 \
       --owner dev@example.test --repo owner/name --ide

4. Open it

   The owner signs in and opens it from the portal.

   PortalHomeacme / dev01

Defaults: 2 GB of RAM and 2 CPUs per workspace, and an idle workspace suspends after 30 minutes.

Connect an AI provider

1. Choose the models

   An operator names the models behind each tier: Lite, Economy and Power.

   ConsoleSettingsAI agents

2. Add organisation keys

   Add an organisation's Gemini key, or its Codex and Antigravity sign-ins for the CLIs.

   OrganisationsacmeAI keys

3. Decide who may use which provider

   The chat speaks the Anthropic and OpenAI dialects; Gemini works through its OpenAI-compatible endpoint. An organisation decides which providers each member may use.

4. Keep keys out of containers

   At the default Guarded security level, the Claude credential stays on the host behind the model proxy, and each workspace gets a key that is worthless off the host.

Only Anthropic is fully brokered. The key broker for other providers is off by default, the Antigravity CLI in the workspace does not use it, and some AI APIs can be reached directly.

Configure egress

1. Watch first

   Egress ships in observe: the proxy decides and logs each connection and still lets it through. The direct-GitHub refusal, the DNS filter and the copy-port controls refuse in every mode, observe included. Let your team work for a week.

2. Build the allowlist from what they reached

   on the hostCopy

   $ bin/egress-proxy summary --days 14

3. Add what is missing

   Hosts are comma separated; a leading dot means “and subdomains”. An organisation's list is added to the host's and can never remove from it.

   on the hostCopy

   $ bin/policy set --scope tenant --target acme \
       --key egress_allowlist --value 'registry.example.org'

4. Promote to deny

   This takes effect on the next connection, with no restart. Flip it back the same way.

   on the hostCopy

   $ bin/policy set --key egress_enforce --value deny

Two controls: the firewall makes the proxy unavoidable; the allowlist is what filters. Deny decides by hostname, does not inspect payloads, and npm publish to an allowed registry can still upload code.

Turn on the validation gate

1. Approve at least one check

   The gate runs the organisation's approved checks on the exact commit being pushed.

   OrganisationsacmeChecks

2. Require a passing validation

   Turn the gate on for one organisation, from the host.

   on the hostCopy

   $ bin/policy set --scope tenant --target acme \
       --key git_validation_gate_enabled --value true

3. Validate, then push

   In the workspace's Git panel, Validate runs the checks on this commit, and Push goes through the broker.

4. Read the record

   Every allowed push is written to the audit log with who wrote each commit: agent, console or person, and unattributed when the host has no record.

No approved check means every push is refused. The gate is off by default and has not yet been seen on a real GitHub push.

Grant governed runs

1. Know the default

   Governed runs are background agent runs. They are off for every organisation until an admin grants them. The console still labels the setting “Live execution”.

2. Prepare the evidence on the host

   on the hostCopy

   $ bin/deployment-readiness --prepare

3. Grant it for one organisation

   The grant is only accepted against a proven evidence record.

   OrganisationsacmeSettingsLive execution

4. Re-grant after every commit

   A grant is tied to the commit it was proven on. Deploy a new commit and execution stops until you prepare and grant again.

Measured with Claude Code only. A grant is tied to one commit and lapses with the next deploy, by design.

Attach a desktop IDE

1. Turn on Desktop IDE attach for the organisation

   The switch warns that code can leave the platform through a desktop client. Read it.

   OrganisationsacmeSettingsDesktop IDE attach

2. Register your public key

   WorkspaceDeveloper toolsKeys

3. Take a token from the Connect pane

   It is shown once and lasts 12 hours. It is never stored in the browser.

   WorkspaceDeveloper toolsConnect

4. Download the helper and connect

   ~/.ssh/configCopy

   Host acme-dev01
     User dev
     ProxyCommand workspace-ssh --url https://kodela.example.com/ws/acme/dev01/ssh \
       --token-file ~/.config/kodela/acme-dev01.token

5. Open it in VS Code or JetBrains

   VS Code Remote-SSH or JetBrains Gateway, pointed at acme-dev01. JetBrains also needs File transfer set to upload.

Off by default. Your host needs an https address a desktop client can reach. No port is published; the route runs through the front door.

Export audit to a SIEM

1. Check the chain is intact

   on the hostCopy

   $ bin/audit-log verify

2. Export in your SIEM's format

   cef for Splunk and Sentinel, leef for QRadar, json, csv, or syslog (RFC 5424).

   on the hostCopy

   $ bin/audit-log export --format cef --stream egress --out egress.cef

3. Or export from the console

   ConsoleAudit logExport for SIEM

Export is a file you ship. Nothing pushes to a SIEM or copies the record off the box yet. Retention is 90 days by default, and an organisation can only raise it.

Why is it stuck?

1. Open the tab that asks the question

   Organisationsacme“Why it’s stuck”

2. Read the five gates

   Chat dispatch allowed, runtime permitted, execution grant and evidence, session, and model. The first red gate is the reason.

3. Fix that one, then re-check

   Each row names its own remedy and where to apply it. Readiness on the host says the same thing from the other side.

   on the hostCopy

   $ curl -s http://127.0.0.1:5000/api/readyz

A refusal is a sentence. If a gate is red and its row does not say why, that is a bug worth reporting.

Before you rely on these

• Several of these are off by default: the validation gate, Desktop IDE attach, governed runs and the key broker. Each is off until an admin turns it on.
• Egress deny is a setting, not a default. A fresh host observes and logs; it does not block.
• The shared front-door password is not tied to a person until “require identity” is on. Turn it on once everyone has an account.

Next

Verified against the main branch, 28 Sep 2026.