AGENT DESKS
Give each agent its own desk¶
Your company's agents work on your code from a desk: an isolated workspace on your own machine. The agent reaches only the services you connected, your keys never enter the desk, and every job it runs is checked by EKKA before it starts and signed after it ends.
An agent desk is an isolated workspace where one AI agent does one approved job, and where EKKA decides who and what may use it.
This page is for teams that want AI agents working on their repositories with the company's keys, under the same controls they already expect for people.
Desks run on a desk backend, which isolates each desk and holds its keys. Today the desk backend is NVIDIA OpenShell: see EKKA with NVIDIA OpenShell for what it does, what it needs and how to install it.
The desk backend holds every desk to its policy: which programs may reach which hosts, and which folders may be written. EKKA adds the other half: which agent may work on a desk, a person's approval before work runs on a desk that changed, and a signed record of what happened.
A desk is where the work happens. The keys, the decision to allow it, and the record of it all stay outside the desk, where the agent cannot touch them.
What can an agent on a desk reach?¶
Only what a person connected. A desk starts with no route anywhere.
- The services you connect, and nothing else. Connecting a key names the
only hosts it opens and the only programs that may use them. Connecting
Claude Code opens
api.anthropic.comfor theclaudeprogram. - Your keys stay in the desk backend. The agent sees a placeholder. The desk backend puts the real key into a request only when that request goes to one of the key's own hosts.
- Its own work folder and
/tmp. Everything else on the desk is read-only, and programs run as an ordinary user.
Who can do what?¶
| Who | What they may do |
|---|---|
| An organization admin | Ask for a desk change: create, stop, start or delete a desk, change what it may reach, or detach a key. Each change is a governed plan run, recorded with a receipt. |
| A person, signed in | Read desks, what they may reach, and the keys they use, under their own sign-in, which only reads. Approve a changed desk. |
| The agent | Run the jobs its plans name, on the desks a person granted it, and nothing else. |
| The Enclave, EKKA's process on your machine | Run approved jobs on desks, and carry each approved desk change to the desk backend's adapter. A change and a job never run on one desk at the same time. |
| The desk backend's administrator | Add and remove people (sudo ./up.sh invite <user>, sudo ./up.sh revoke <user>) and set keys from a pipe (gh auth token \| sudo ./up.sh connect github), on the desk backend's machine. |
| The desk itself | Nothing about its own limits. A desk cannot widen its own policy. |
Who can change a desk?¶
EKKA governs desk administration from request to execution. Only organization admins can request changes, and each one is a governed plan run. Govern signs the authorization, and the desk backend's adapter, which runs on your machine, verifies it and enforces the approved limits before it acts. The adapter is open source and signed in public; see how it is checked before it runs.
The keys your desks use stay in the desk backend. The credential EKKA uses to ask the backend for a change stays in the Enclave's vault, never in a plan, a receipt or a log.
ekka desk stop code-desk # a governed plan run; prints the run and its receipt
ekka receipts show <run-id> # who asked, what was approved, and what happened
When a change is still running¶
A change holds its desk until it finishes, so no job and no other change runs there meanwhile.
ekka desk locks # which desks are held, by a job or by a change
ekka desk status code-desk # the desk's state; it says so while a change is still running
ekka desk status also checks again a change whose outcome was not known. If it
still cannot say, read the desk and release it with the change's operation:
EKKA refuses a release while the change is still running.
How does code get onto a desk?¶
Through the desk's setup plan, as governed work with a receipt. A desk starts empty: a create carries no repository, and a create that names one is refused.
How does an agent work on a desk?¶
A plan's job step names the desk as desks/<name>, and the agent needs a Grant
for job.run on that desk. The Grant is the permission; without it the step is
refused before anything starts.
ekka desk show code-desk # the desk, its pins, and the exact Grant it needs
ekka plan run <plan-identity> --input question="Where do we validate uploaded files?"
ekka receipts show <run-id> # what ran, on which desk, with which instructions
Every job step is checked against the Grant before it starts, and signed after it ends. The prompt the agent runs travels with its fingerprint, and the Enclave refuses anything that does not match. Running jobs on desks is included in every edition: see Pricing.
How do I change what a desk may reach?¶
An organization admin asks for the change, and a person approves the new policy before work runs on the desk again.
ekka desk allow code-desk --program /usr/bin/curl --host api.example.com
ekka desk deny code-desk --program /usr/bin/curl --host api.example.com
ekka desk policy show code-desk
Each change shows the old and new policy side by side and asks before it runs. It is a governed plan run, recorded with a receipt, and it applies only if the desk is unchanged since it was read. A change and a job never run on one desk at the same time. After a change, the Enclave runs no work on the desk until a person approves the new policy on the Enclave's machine:
The same approval applies when a desk is deleted and made again under the same name: the new desk is a different desk, and work waits for a person.
Limits¶
- A desk backend has its own machine requirements. For NVIDIA OpenShell, see Requirements.
ekka desk list,show,addandrepinrun on the machine where the Enclave runs.- A desk's work folder is working state, not a system of record. Work that matters leaves it through a governed step, such as a pull request.
Every ekka desk command is in the CLI reference.