Every key and session token belongs to one workspace. On each request the server takes the workspace from the credential, never from the request body, and scopes every read and write to it. Scoped to the workspace: rule sets (all versions), the check log, the tool registry and mappings, capture requests, per-person rule sets, company documents. MCP tools scope themselves too, since an MCP transport can run them outside the request. Tested: a key from workspace A can’t see or check B’s maps, checks, tools, requests or MCP reads (server/tests/test_accounts.py). Caches are keyed by workspace as well: routing decisions and judge verdicts from one workspace are never served to another.

​
Not scoped yet

  • Capture sessions and their logs, and keyframes. Their ids are random and never listed, but they aren’t checked against your workspace.
  • Anything made before accounts lives in the default workspace.
The server’s database is on persistent storage: accounts, sessions and keys survive restarts and deploys. See Data retention.