Workspace controls
Everything a workspace lets you configure — enforcement mode, the egress allowlist, alerts and SIEM delivery, and the request-rate limits that apply to your plan.
A Sentisec workspace is deliberately small to configure. There are no rule files to author and no policy language to learn — you decide what your agents can do, whether Sentisec blocks, where your agents are allowed to reach, and who hears about it. Everything else the engine works out for itself.
Protection setup
The four screens that register what your agents can do, before you choose when to block. Start here.
Posture ladder
Four rungs, each a promise about what may block. Moving up takes evidence; moving down never does.
Enforcement mode
The two-state view of the ladder: shadow records verdicts and
changes nothing, enforce blocks.
Egress allowlist
The hostnames and IP ranges your agents legitimately reach.
Approval for payments, messages and contact changes
Make money movement, outbound messages and contact changes wait for an admin's approval. No learning step needed.
Alerts and SIEM
Get told when something happens, and forward events to your SIEM.
Keys management
Workspace API keys and upstream provider credentials.
Who can change what
The posture rung, enforcement mode, the egress allowlist, the approval policy, provider credentials, API keys, and the integration settings are all administrator-only. Members can read the workspace, its sessions, its evidence, and every requirement standing between it and the next rung — but cannot change what it enforces.
Roles come from your organisation. See RBAC for how they map.
Every one of those changes is written to the workspace's audit log — who changed what, when, and from what to what. The log is hash-chained, so a missing or altered entry is detectable.
Request-rate limits
Each plan allows a number of requests and tokens per minute. They are derived from your plan rather than edited per workspace, so there is nothing to configure.
A request over a limit gets a 429 with Retry-After, in your
provider's own rate-limit format, so the provider SDKs wait and retry on
their own. The limits per plan, how a request is counted, and where to
see how often a workspace was refused are in
Rate limits.
Repeated authentication failures from one address are also rate-limited, which is worth knowing if you are testing key rotation in a loop.
Need a higher ceiling than your plan allows? Get in touch.
Isolation between workspaces
A workspace is a hard boundary, not a label. Its provider credentials,
its API keys, its sessions, its evidence, and its settings are its own.
Running production and staging as separate workspaces means a key
minted for one cannot read or affect the other.
Related
- Dashboard — where all of this lives
- Keys management
- Enterprise — SSO, RBAC, SCIM, in-VPC
Keys management
The two keys in Sentisec — the workspace key your agents authenticate with, and the provider keys Sentisec forwards with on your behalf.
Protection setup
The guided setup that turns a connected workspace into a governed one — register what your agents can do, classify each action, check your rule names actually reach it, then choose when to block.