---
title: "Policies Workspace"
slug: "ai-workspace"
status: "update"
updated: 2026-07-19T13:00:20Z
published: 2026-07-19T13:00:20Z
canonical: "docs.plainid.io/ai-workspace"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies Workspace

The **AI Workspace** is a centralized environment for defining and managing permissions for AI-enabled applications.

Each Workspace represents a real Application in your organization, whether an internal tool, customer-facing product, or shared service that uses AI capabilities. The Workspace acts as the **authoritative boundary** that defines what users and **Agents** are permitted to do.

Within an AI Workspace, you define:

- The **Application** context you are protecting.
- The **Policies** that govern how components in the agentic ecosystem can interact with that **Application**.

## Security Model

The AI Workspace is built on a **least-privilege** approach. By default, users and **Agents** have **no permissions**.

Every capability, such as invoking an AI **Action**, accessing a protected **Asset**, or interacting with an external system, must be **explicitly granted through a Policy** with fine-grained conditions.

**Policies** define what is allowed, not what is blocked. Any access not explicitly granted by a **Policy** is **denied by design**. This model ensures that access is intentional, auditable, and aligned with business requirements.

## Separation of Concerns

The following entities are defined and managed in their own dedicated Workspaces:

- Users.
- AI **Agents**.
- Tools, such as MCP servers.
- Data sources, such as RAG repositories.

The AI Workspace **consumes** these external definitions and applies **Policy** decisions to them without owning their lifecycle.

---

In the following sections, you will learn how to define and manage **Policies** that grant precise, least privileged access across your AI stack.