Who can do what, and what proves it

Customer-hosted identity integration and hosted workspace sign-in have different scope. Confirm the identity provider, roles and access lifecycle for the selected deployment.

Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.

A policy decides what an agent may do on its own; an approval is a human decision it waits for; an evaluation is the review a skill passes before it is trusted.

Execution follows the configured host policy. A command can be approved, denied or referred for human review; individual approval depends on that policy.

Host investigations provide the command evidence behind a result: commands, exit codes and output. Review that evidence before accepting a recommendation.

Host investigations show the commands that ran, their exit codes and output, per host.

Administrative changes to the fleet are written to an audit log in the control plane.

Administrative actions — such as raising a host's execution policy or moving a host between workspaces — are recorded to an audit log with the actor, the action, the subject and the values before and after the change.