Governed workspace. All the tools. None of the exposure.
Process, join, and enrich your data with real tools. Full audit without anything sensitive reaching the model.
A persistent sandbox for data work.
Load data across systems. Process it in code instead of context.
Connections land data in DuckDB tables. The model writes SQL to join, filter, and enrich it across systems · Python and shell for the rest.
Every query and script persists, versioned and diffable · The next task starts from what the last one built.
Raw data files are cached as-is · CSV, JSON, Excel, database files. The DuckDB database is itself a file in the workspace.
# The workspace after one task workspace/ ├─ data.duckdb │ ├─ salesforce_opportunities cached · 18 rows │ ├─ jira_issues cached · 64 rows │ └─ slipped_deals_joined materialized · 14 rows ├─ files/ │ ├─ q2_pipeline.csv │ └─ deal_reviews.json └─ queries/ ├─ slipped_deals.sql persisted └─ blockers_by_account.sql persisted # The model saw 14 rows · Not 82.
Raw records never enter the model window. Fewer tokens. More right answers.
Enrichment without exposure.
Agent workflows need flexibility · Data protected in motion.
Sensitive data is spotted in motion, as it enters the workspace · No inventory to pre-build or keep current.
Tokenization withholds values from models and people alike · What each one sees is decided dynamically, by permission and policy.
Workflows get full use of sensitive data — the percentile, the policy fit — while the values stay protected.
# What the model works with customer tok_cus_9f42 contact tok_eml_22d1 mrr tok_amt_58aa renewal_date 2026-09-30 usage_90d −18% policy_fit within approved band # What the authorized approver sees customer Acme Industries contact dana@acme.com mrr $84,000
Build the runtime path once · You stop re-solving security for every new workflow. That is what moves AI from pilot to production.
Every tool call, on the record.
You can't pre-approve an agent's path · You can audit every step it takes.
Every query and data-source hit streams as a structured event to Splunk, Datadog, or the SIEM you already operate.
Queries persist and data is cached · The audit shows exactly how the data was worked — and can run it again.
Files users bring in are logged and attributed like any source · Enforced by the architecture, not by user training.
# Example · SIEM event from one workspace query
{
"timestamp": "2026-06-04T16:42:01Z",
"user": "j.smith@example.com",
"workspace": "cs-ops",
"tool": "connection_query",
"system": "salesforce",
"rows_returned": 47,
"tokens": 8240,
"model": "claude-sonnet-4.5",
"credential_scope": "cs_read",
"pii_tokenized": true,
"workspace_action": "join_materialized"
}Compliance evidence is a byproduct of the runtime. Nothing to reconstruct at audit time.
Every path your agent actually takes.
Found in flow. Controlled in use. Audited as taken.
A useful agent decides its route at runtime · The user's goal picks the systems. Map every workflow in advance and the next request invents one you never listed. So what used to be phases around a workflow happens during use.
A discovery project before rollout.
Sensitive data found as it flows.
Approve the workflow in advance.
Access monitored, policies applied in use.
Review what happened, after.
The path recorded as it's taken.
Common questions about the governed workspace.
Does the LLM ever see raw enterprise data?
No. Data returned from your connections lives in DuckDB inside the workspace. The model writes queries against it but sees only the synthesized answer. Raw rows, credentials, and tokens never enter the model context window.
What about sensitive fields the agent needs to reason about?
Sensitive values are tokenized before they reach model context — meaning intact, values withheld. The agent reasons over the account without holding the customer's name, number, or payment detail; authorized users see real values on their side of the boundary.
How are credentials handled?
Credentials are scoped per identity, encrypted at the workspace boundary, and never enter the model context. Real-time revocation cuts access at the workspace layer instantly · Across every AI surface the user touches. SSO and SCIM cascade from your IdP.
What does the audit trail look like?
Every tool call streams to your SIEM as a structured event · User, workspace, tool, system, tokens, model, credential scope, PII redaction status. Splunk, Datadog, or your-own-SIEM. The audit pipeline your security team already operates.
How does the workspace cut token spend?
Work happens in code before context. Joins, filters, and refinement run in DuckDB; the model reasons over the result, not the raw records.
Is the workspace portable between AI surfaces?
Yes. The same workspace context, queries, joins, and skills back Claude, ChatGPT, Cursor, Copilot, Codex, Slack, and custom apps. Switch surfaces; the workspace stays.
Scoped credentials. Tokenized data. SIEM stream. Architecture, not policy.
Bring it to your security review.
CISO one-pager · Architecture diagram · Controls matrix · Sample SIEM events · NDA template. Everything your security team needs.
