Single Sign-On
People sign in with their company account through Okta, and admins can require it for everyone.
SECURITY, BY DESIGNCapable Assistants.
Capable Assistants.
Organizational Control.
A managed agent environment with isolated workspaces, protected connections, approvals, budget controls, audit logs, and approved plugins.
01 / Isolated environments
Isolated Runtime
Every hosted agent runs in its own sandbox. Its workspace and available capabilities define where the work can happen.
NVIDIA OpenShell provides the hosted runtime boundary. Your agent uses the tools and connections configured for that environment.
- Dedicated agent workspace
- Runtime isolation
- Explicit tool access
02 / Credential protection
Protected Connections
Use dedicated connection and credential controls to authorize your tools, instead of pasting passwords or API keys into a conversation.
Managed app connections use provider authorization. Custom credential slots use the platform’s encrypted storage and scoped access. How a secret is consumed depends on the integration.
- Provider authorization
- Encrypted credential storage
- Scoped connections
03 / Human control
Action Approvals
Configure which actions require a review. When approval is required, the agent pauses so you can inspect the request before it proceeds.
An app connection gives an agent access to available capabilities. It does not replace your approval policy or the permissions on the connected account.
- Review before execution
- Approve or reject
- Permissions still apply
Manage How Assistants Work
Apps Policy
Choose which apps members can connect. They can request a locked app with a reason, and admins approve or decline.
Member Budgets
Give each member a monthly budget, and see which apps and channels every assistant uses.
Stop and Offboard
Stop one assistant or all of them at once. Deactivate a member or the whole organization, and their assistants and connections are removed.
Audit Visibility
Review operational agent activity under your organization’s permissions. Employees choose what to share from their impact summaries.
Approved Plugins
Connect supported apps and use their existing account permissions.
Security Is Part of How We Work
Principle of Least Privilege
Access follows need to know. Our team can reach only the systems its role requires, and any support access to a customer environment is temporary and read-only.
Routine Penetration Testing
As part of monday.com, we run penetration tests with the monday.com security team as a routine part of how we work.
Security Questions
A practical look at the controls around your agents.
Still have a question? Talk to our team
Bring Your Security Questions.
Walk through the architecture, controls, and requirements with our team.