Security and controls

How the workspace is kept apart, what is recorded, and how to stop everything.

Your workspace is separate

Each workspace runs as its own process under its own system account, with its own database, files and sign-in organization. Agents in one workspace cannot read another's data. Sign-in goes through your workspace's identity provider.

Audit log

Security-relevant actions (agent turns and the account they ran on, commits, changes to limits, access and keys) are written to a tamper-evident log: each entry is chained to the one before it, so an edited or deleted entry shows. Administrators read it under Settings → Audit.

Limits and the emergency stop

Administrators set turn and spend caps (daily and monthly) under Settings → Limits. Stop all turns stops every running agent turn in the workspace at once and pauses new ones until they are turned back on.

The vault

Secrets your agents need (for example a token for a private repository) are kept in the vault, locked by a passphrase of at least 16 characters. A secret is granted to specific repositories, and their agents receive it only while the vault is unlocked. An administrator can mark a secret long-lived so scheduled work gets it while the vault is locked; every read of it is recorded.

Workspace and project secrets

When a chat or a scheduled job has to reach something outside app.evriq.ai -- a mailbox, an API, a database -- give it the credential as a secret. There are two scopes. A workspace secret (an administrator, under Settings → Secrets) reaches every chat, session and job in the workspace. A project secret (an administrator or anyone who works in the project, in the project's Secrets section) reaches only that project's sessions and jobs, and wins over a workspace secret of the same name.

Each secret arrives as an environment variable of its own name, in every agent turn and job run it applies to, with nobody needing to unlock anything: a job that fires at 07:10 has its credential at 07:10. Values are write-only: once saved a value is never shown again, and replacing one means typing a new value over it. Secrets are encrypted at rest, and each one reaches the agent as a plain environment variable, so the agent process can use it and can read it while it runs: give a chat only credentials you are content for an agent to hold. As a safety net, the exact value, and its base64 and percent-encoded forms, are masked out of what a chat says or prints and out of job output (best effort: a value an agent splits or re-encodes by hand is not caught, and a value shorter than four characters is not masked). Every change and every read into a turn is recorded by name, never by value. From a terminal: evriq secrets list|set <NAME>|delete <NAME> [--project <name>], the value read from standard input.