Skip to main content

The two work boundaries

Cells are where compute and storage physically live (see the cell model). Work, though, always happens inside one of exactly two boundaries (a workspace or a clean room) and choosing between them is a single architectural decision, not a matter of taste or data sensitivity.

Both are whole, portable working environments rather than folders. This page is the decision. The deep feature treatment, provisioning, roles, the egress gate, cloning and mobility, lives under the Data Platform; here we cover which boundary to reach for and why.

The deciding question​

The decision is governed by one question, and it is not "how sensitive is the data?" It is "how many trust domains are in the room?"

Figure A3: the two work boundaries. The single-border enclosure is a workspace (one trust domain); the double-border enclosure is a clean room (two or more mutually-distrusting parties). The choice turns on the number of trust domains, never on how sensitive the data is. Ceiling: a clean room runs on one cell at a time, so moving one is a cutover rather than a live spread, and a clean room is policy-based isolation with a signed run chain, not a hardware trusted execution environment.

Table equivalent

BoundaryGlyphTrust domainsWhat it isWhere isolation sits
Workspacesingle borderoneThe universal ownership and collaboration boundary; members trust each other and have full accessBetween workspaces
Clean roomdouble border + party dividertwo or moreA mutual-distrust governance overlay on a host workspace, so parties compute a joint result without exposing raw dataInside the room, between the collaborating parties

Workspace: one trust domain​

A workspace is the universal ownership and collaboration boundary. Every entity gets one automatically: provisioning creates the workspace record, a dedicated storage namespace, a messaging inbox, an owner membership, and default streams. Inside a workspace, members trust each other and have full access, gated by membership role (owner, editor, contributor, viewer) or group grant at the gateway. Isolation is between workspaces, the boundary keeps one workspace's work away from another's, not one member away from another inside the same room.

Reach for a workspace whenever the people and agents in the room are on the same side. That is the common case, which is why every entity is provisioned one without being asked.

Clean room: two or more trust domains​

A clean room is a mutual-distrust governance overlay layered on a host workspace, for two or more parties who must collaborate but do not trust each other, and who need a joint result without any party exposing its raw data. A new room is created deny-all by default. Its distinguishing controls are about separation of duties and controlled output rather than shared access:

  • Per-room collaborator roles (admin, contributor, reviewer, runner, observer) enforce separation of duties inside the room, a party may contribute data but never run, or run but never see another party's output.
  • Asset aliasing means the only name another collaborator ever sees is a per-room alias; compute is rewritten to aliases before it runs, so a kernel never sees a source table's real name.
  • Approval-gated, signed compute must be reviewed and cryptographically signed by multiple reviewers before it can run; an edit resets the approval.
  • The egress gate passes every output, in order, through k-anonymity, an output-row cap, a per-collaborator privacy budget, a destination allow/deny list (default deny), and content inspection, the first failure terminates the run.
  • A signed, hash-chained run audit records every run tamper-evidently: the documented compensation for not relying on a hardware enclave.
What a clean room is, precisely

A clean room is policy-based isolation with a signed run chain, not a hardware trusted execution environment. A room runs on one cell at a time, and cross-cell clone, archive and recovery move it between cells as a cutover, each vetting the target fail-closed. The differentiator is where the room can run: on-premises, air-gap-capable, and sovereign, on the same estate as everything else.

Both are whole, portable environments​

Neither boundary is a folder. Each opens as a first-class console of its own, and because workspaces and clean rooms belong to a node rather than living inside one, each is a portable unit: it can be cloned, archived, moved between organizations, and failed over as a whole, independent of which cell its data currently sits on. That portability is why the choice of boundary is an architecture decision, it determines the governance model a whole environment carries with it, everywhere it goes.