Workspace - HarnessRouter Docs | HarnessRouter

Scope

• API keys are Workspace-scoped.
• Configured agents are found or created inside the selected Workspace.
• Sessions and returned files belong to the Workspace that served the runtime task.
• A missing configured agent can mean the key was created from a different Workspace.

Product records

Your product should still keep its own user, tenant, feature, session, response, and artifact records. Do not expose account-wide Workspace session listings directly to end users.

Open standard

Workspace-scoped keys, configured agents, sessions, and returned files are HarnessRouter's implementation of UHP's object-scope rule: every object belongs to the principal whose credential created it, on every operation. See Security considerations in the Unified Harness Protocol.