Agent.Space
Conversations, the file panel, transfers
- A bound computer starts with no folders. You add them one by one.
- A conversation starts only in a folder you added.
- The file panel reads and writes only inside them.
Security
Cloud Agents, your computer.
Is that safe?
Your computer starts the connection, and Agent.Space uses only the folders you add. The Agents on it run as your own system account, with no sandbox from us.
Agent.Space Workspace
- Keeps conversations and tool output
- Lets people in by role
Conversation, tool output
Your computer
- Uses only the folders you add
- Conversations and files: connects out, opens no port
Prompts
Model provider
- Gets prompts straight from your computer
- Signs in as you
An Agent on a cloud computer runs in the cloud, not through yours. Remote Screen, which controls a Mac's screen, is not covered here.
- 5minA pairing code works
- 365daysA computer's key lasts
- 7daysAn invite link works
- 3rolesOwner, Editor, Viewer
Agent.Space and our platform never access,
record or view your Workspace.
Model calls and all other data get the highest level of security.
Your computer
starts the connection.
You approve the pairing
An Owner or Editor approves it in the browser. The code works for 5 minutes.
One key, one computer
It belongs to one computer and one member, lasts 365 days, and can be revoked at any time.
Leaving cuts the link
Remove a member, or make them a Viewer, and their computers disconnect.
No Workspace key on the computer
The runtime holds a temporary key only: no Workspace credential, no model key.
Two layers,
looked at apart.
Agent.Space has a boundary. The Agent on your computer does not share it.
The Agent on your computer
Claude Code, Codex and the like
- It runs as your system account, with no sandbox from us.
- How far it reaches depends on its own permission mode.
- On a Mac, the system asks again before Documents, Desktop or Downloads, unless Full Disk Access is on.
“Full access”
means two things.
One is an Agent's permission mode. The other is a macOS setting.
An Agent's full-access mode
- It runs commands and changes files without asking each time.
- On a cloud computer it runs in an isolated container, as an ordinary user.
- On your computer, whoever sends the task chooses the mode. Modes that skip questions show in a warning color.
Full Disk Access on a Mac
- Optional, and off at first. You grant it in System Settings.
- Once on, Agents there open Documents, Desktop and Downloads without a prompt.
Questions an Agent asks
A request shows as Needs you. Only the person who sent the task can answer it. The computer's owner and the Workspace Owner cannot answer for them. Modes that skip questions raise none.
Your computer
is yours alone at first.
In the program, each bound computer is set to Only you or Everyone.
| Only you (the default) | Everyone | |
|---|---|---|
| Who can start conversations on it | Only you | You, and the Workspace's Owners and Editors |
| Who can see the files in your folders | Only you | Every member of the Workspace. Viewers read only |
| Whose login and quota an Agent uses | Yours | Yours, even for a task a teammate sends |
The Workspace Owner has no override. To take it back, set it to Only you.
Private conversations,
seen by one member.
For now, a Ghost's conversation. Ordinary conversations cannot be made private.
Closed to others
The Workspace Owner and the other members cannot open it, and neither can their Agents.
Out of the lists
Not in anyone else's conversation lists, search, discussions or Ghost.
Access, not encryption
Its content is kept in the Workspace like any other.
Three roles,
each a step wider.
Invite links are made for one role and last 7 days.
| Viewer | Editor | Owner | |
|---|---|---|---|
| Read conversations and files | Yes | Yes | Yes |
| Start conversations, send tasks, write files | No | Yes | Yes |
| Bind their own computer | No | Yes | Yes |
| Archive and permanently delete conversations | No | Yes | Yes |
| Invite, change roles, remove members | No | No | Yes |
| Cancel anyone's task | No | No | Yes |
| Delete the Workspace, hand over ownership | No | No | Yes |
An Agent acting through the Workspace API or MCP does so as whoever sent the conversation's latest task.
What you can take back,
and what we have not done.
Any time
- In the program: untick folders, set Only you, remove the binding, or quit.
- In the browser: the computer's owner or the Workspace Owner can revoke a computer.
- Archive a conversation and delete it for good, with its cloud files. Deleting a Workspace asks for its name.
Not done yet
- Agents on your computer have no system sandbox.
- Conversations are not end-to-end encrypted.
- On a cloud computer, ~/.agent-space.env is a plain file any Editor can change. MCP credentials and model API keys are stored encrypted.
- Signing in has no two-step verification.
Found a security problem? Write to support@agent.space, and keep it out of public places.