Workspace Security & Access

Workspace managers can configure interactive access requirements from Workspace settings. Open a Workspace, choose Settings, then Security & Access. The server decides which managers may change these settings.

Required MFA

Required Workspace MFA applies to interactive browser access and editor/realtime entry derived from that browser authorization. It does not configure API bearer-token security; API-token rules remain a separate policy in v1.

Before enabling MFA, the server previews accepted owners who do not have a usable authenticator or recovery method. Resolve those blockers first. Members who already have a session may be asked for a one-time step-up on their next protected Workspace visit; membership and roles are not changed.

Identity and external-member policy

A manager can require a verified company identity domain, allow invited external members, or restrict external members. Before a stricter rule is saved, the preview lists accepted members who would lose runtime access. Their membership and roles remain in place.

Verified company domains

Add a company identity domain in Security & Access, copy the displayed DNS TXT name and value, publish the record, and select Verify. Pending, verified, and failed checks remain visible; a failed check means DNS proof was not found yet and can be retried. This is separate from invitation email-domain admission and Workspace access hostnames.

For invitation-domain admission, see Workspace Policies. For Workspace hostnames, see Workspace Domains.