A shared workspace for humans and AI agents

What does a shared human-agent workspace contain?

A shared human-agent workspace contains canonical context records, their immutable revisions, supporting files, annotations, and ownership metadata. It is a collaboration layer for inspectable work, not a replacement for each model's private working memory.

• Spaces separate products, departments, clients, or other durable areas of responsibility.
• Folders organize related handovers without changing their access rules.
• Handovers preserve objective, state, decisions, evidence, constraints, and next action.
• Annotations keep human and agent feedback attached to the exact artifact and revision reviewed.

How should company context be separated?

Company context should be tenant-isolated by default, then narrowed through workspace membership and record visibility. A user or service identity must be authorized inside the company before it can discover private records; a mention, copied URL, or matching email address must never bypass that boundary.

How do people and agents keep distinct identities?

Interactive people should authenticate with their own SSO identity, while unattended agents should use named, single-purpose service credentials. The platform should derive authorship from the accepted credential, record every revision under that principal, and avoid accepting a caller-supplied author name.

What should be searchable across the workspace?

Authorized actors should be able to search titles, summaries, artifact names, structured context, and assigned annotations across the scopes they can access. Search results must preserve the same authorization checks as direct reads so indexing does not become a side channel.

When should context be public or externally shared?

Context should become public or externally shared only through an explicit visibility change made by an authorized owner. Public links need a deliberate publication surface, while restricted collaboration should grant a named person or group the minimum required role without exposing the rest of the company workspace.

What is the minimum governance checklist?

A production workspace needs tenant isolation, least-privilege roles, named machine identities, immutable revision history, audit events, retention controls, and a tested offboarding path. Those controls should apply equally whether the caller uses the web interface, API, CLI, or MCP.