Skip to main content
Claude Code, Codex and OpenCode are preinstalled in your workstation. Your admin chooses which tools and default models are enabled under the workspace’s AI governance page.

​
Start a tool

Open a terminal in your repository and run an enabled tool:
You do not sign in to the tools separately. Requests go through the node gateway, which adds your KolaOS AI key outside the workstation before forwarding the request to the AI gateway. Your organization supplies the provider connection. If a tool shows No provider, Model not served or Provider not working in KolaOS, ask an admin to check AI providers. The organization spending cap can also block requests.

​
Prompt records

KolaOS records AI requests and responses. Recording cannot be turned off. Organization admins can read and delete prompt records, and each read is audited.
For KolaOS Cloud and Your AWS account, KolaOS stores prompt text in a KolaOS-owned S3 bucket for the AI gateway’s data region. Prompt text is not currently stored in your own AWS account. The control plane keeps an index of the records. For Your servers, prompt text stays on the AI gateway on your server, and the control plane receives the index. When an admin opens a record, KolaOS retrieves its text from the gateway. Admins choose retention of 7, 30, 90 or 365 days under Organization, then AI providers, then Prompt retention. The default is 30 days. Admins use Prompt records to read or delete individual records. Use the refresh control to fetch records KolaOS has received. A request still running or a record in transit may appear on a later refresh.

​
Permissions and limits

An AI tool runs with access available inside your workstation. It does not gain narrower permissions merely because it is an agent, and it can use credentials it can read there. Do not give a tool credentials for actions you do not want it to perform. Anything inside a workstation or on a laptop only deters, because the developer has root there. Preinstalled tool configuration routes requests through KolaOS, but direct provider destinations are not currently blocked on nodes. The workspace’s Internet access setting is not enforced yet. The organization cap is enforced. Separate member, workspace and automation spending limits are not enforced today.

​
Connected work tools

An admin can connect Linear or Jira and grant a workspace access to selected teams or projects. Enabled tools receive KolaOS MCP tools for those grants. The API checks each call against the workspace grant and keeps provider tokens outside the workstation. Ask an admin to review the workspace’s integration grant when an operation is refused. Adding a task description or changing instructions inside the workstation does not grant access.