Security and connectivity

Evaluate Lobby's workspace isolation, credentials, storage, regions, and network limits.

Lobby runs agents in cloud workspaces. The account, repository, conversation, and run determine what the control plane permits; the workspace receives scoped, short-lived capabilities instead of control-plane or provider master credentials.

Workspace boundaries

Private and disposable conversations use isolated MicroVMs. Shared project conversations use a project host: members attached to the same project share its branch checkout, Docker daemon, localhost network, and persistent volume. Treat those members as trusted peers. File claims coordinate edits but do not prevent every shell or background process from overwriting a peer’s work.

Cloud workspaces allow the public development endpoints needed by the managed sandbox. A customer-configurable VPN, private-network connector, IP allowlist, or proxy/TLS-inspection setup is not currently exposed. Do not assume a cloud agent can reach an internal source host, package registry, database, or API because a member’s own computer can reach it.

Credentials and approvals

The GitHub clone credential is short-lived and restricted to the selected repository. Model-provider credentials remain in the model gateway.

For a repository-managed development service, an owner or admin can configure a supported AWS cloud role. Lobby assumes the customer role for up to one hour and gives credentials only to that managed service through the standard AWS container credential provider. The agent and interactive terminal do not receive the STS keys. Disabling or rotating the binding blocks refresh; revoke the customer role itself when an already-issued AWS session must stop immediately.

Keep application secrets out of repository files and prompts. Lobby can redact credentials it issued, but it cannot reliably identify a secret fetched and printed by application code.

Storage and transport

Conversation attachments, demo videos, and workspace checkpoints are private, account-scoped storage. Their storage buckets block public access and require TLS; stored objects use AWS KMS encryption. Downloads and playback recheck account and repository access. A shared demo URL does not grant access by itself.

Regions and data location

Shared projects select a home region when created. The host, project disk, snapshot, gateway, and runner logs stay in that region. The primary web service, database, authentication, model providers, and source host may remain elsewhere. Region selection is therefore compute locality, not complete data residency, and changing a project’s region is not currently supported.

Enterprise capability status

Lobby does not currently document customer SSO or SCIM, audit-log or SIEM export, customer-managed encryption keys, compliance attestations, customer private networking, or endpoint-management policy. Treat those as unavailable unless a new product guide explicitly describes setup and verification.