Access workspace

Access separates product administration from data authorization. Account roles determine which controls a person may operate; grants determine which Source data a principal may query.

Principals

The ledger includes humans, agents, FDE/support identities, and services. Each row shows identity, kind, authentication state, grants, last use, recent query count, and any issue. Authentication states are active, pending, revoked, or expired.

Create an agent

Choose Create agent, name the integration, and complete WorkOS Agent Registration or copy the one-time-visible WorkOS API key. Store that key immediately in the agent runtime. It cannot be shown again, and Combined stores only a reference and obfuscated display value.

Select the exact Sources the agent needs. Ordinary grants never inherit future Sources. Test a small query before moving the credential into production.

Grant options

Each grant binds one principal to one Source and supports:

• permission: query or manage;
• datasetIds: empty for the whole Source or an explicit dataset allowlist;
• expiresAt: an ISO 8601 expiry or null;
• maxRows: 1–10,000 rows per query;
• maxBytes: up to 256 MiB of estimated input per query;
• maxQueriesPerMinute: 1–60 requests per minute.

The effective query bound is the strictest applicable system, Account, and grant limit. Multiple Source grants may be used in one query, up to the platform's eight-Source bound.

Revoke

Revoking a grant prevents future admission and increments grant_version. Before returning, every in-flight query compares its starting version with the current Account version. A mismatch discards the result and records revoked.

Revoking an agent credential additionally prevents authentication. Use that action when a secret is lost or the integration is retired; removing a single Source grant is sufficient when only scope is changing.

Combined support access

The only future-Source wildcard is the visible Combined support/FDE policy. It applies only to active members of Combined's internal WorkOS organization with the configured FDE role. Owners control the policy, and every use is written to Activity. Ordinary humans and agents cannot receive this wildcard.

See Grants and revocation for the authorization model and Authentication for credential handling.