SecurSpaces as a platform for agentic workloads

Last published : Oct 22, 2026
Enterprise AI is moving from answers to actions. Agents now read corporate information, use tools, call applications, and carry out work on behalf of employees. To be useful they need access, but that access must not expose sensitive data, credentials, or infrastructure. Citrix SecurSpaces™ provides the governed environment where that work can happen at enterprise scale.
Developers are the use case SecurSpaces is best known for, and most of this documentation is written for them. The workspace a developer uses is not specific to code, though. It is a contained Linux environment with its own files, tools, network policy, and credentials, and the same environment can host an AI agent, an analysis, or an application built for a business team.
The goal is not a separate platform for each kind of work. It is one governed foundation that many kinds of agentic work run on.
Note:
A workspace is the product's name for this environment, and it is the term used throughout the documentation and the console. Agentic platforms often call the same thing a sandbox. In SecurSpaces, the sandbox an agent runs in is a workspace.
Related information
About SecurSpaces

One model, many workloads

Each workload needs different tools and different access, but the delivery mechanism is the same: the workload runs in a workspace that contains the capabilities it needs and reaches only the resources it is permitted to use.
These workloads already run on SecurSpaces. They are examples, not the limit of what the platform supports.
Workload What it looks like Who interacts with the workspace
Developer agents A developer runs a coding agent in their workspace and watches what it does. For longer tasks, such as a code migration, an engineering lead describes the goal and how to judge the result, and an agent platform runs the task in a SecurSpaces workspace on its own. The developer, or no one: an external orchestrator starts the work and collects the result
Knowledge worker agents Teams outside engineering, such as finance, legal, operations, or sales, work with an agent in a chat. It reads and writes documents, uses connected business tools, and carries out multistep tasks. Knowledge Worker Agent is an open-source example of this workload, built on SecurSpaces. Business users, through a browser
Citizen-developer applications A business team builds an application, often with AI assistance, and runs it in a workspace so it inherits the same isolation, credentials handling, and audit as everything else on the platform. The team that uses the application
The same pattern extends to further personas over time, such as operations, support, research, finance, and security agents, and to new categories of agentic application.

What every workload gets

Because every workload runs in a workspace, every workload gets the same three properties from the platform.

Security and isolation

A workspace places an explicit boundary around the workload. It contains the files, tools, and connectivity the task requires, and resources outside that boundary stay unreachable unless they are explicitly permitted. An agent does not need access to an employee's entire computer because the employee is authorized to use it.
  • Contained execution. Each workspace is an isolated container with its own file system. See How it works.
  • Credentials kept out of reach. The SecurSpaces proxy service injects repository and service credentials into outbound connections, so the workload uses them without holding them. Secrets you choose to mount into a workspace are the exception: those are readable inside it.
  • Scoped network access. Network policies limit which destinations a workspace can reach.
  • Data protection. Clipboard, upload, and download controls govern what leaves the workspace through the user's session.

Standardization and diffusion

A successful workload can be packaged once and provisioned many times, without being rebuilt for each user.
  • Templates. A workspace template captures the container image, tools, repositories, resources, and settings a workload needs. Once validated, it can be provisioned repeatedly.
  • Images and toolchains. Custom images carry the software a workload depends on.
  • Organization. Workspaces belong to projects within organizations, so different business units or teams can receive different templates and policies on the same platform.

Observability and accounting

As use grows, the platform shows what workloads are doing, who uses them, and what they consume.
  • Audit. Platform activity is recorded on the Audit page and can be exported to your SIEM system. See SIEM integration.
  • Usage. Insights report activity and resource use across projects.
  • AI consumption. With AI Gateway routing, SecurSpaces attributes AI requests to the user, project, and workspace that made them. That is the basis for budgeting and internal chargeback of model costs.

The lifecycle

Together, the three properties give agentic work a repeatable lifecycle:
Step What happens Where it is documented
Package Define the environment a workload needs Templates, Workspace images
Secure Limit what it can reach and what it can hold Network policies, SecurSpaces proxy service
Deploy Provision it for the users or systems that need it Package and deliver a workload
Organize Group it by team, project, or business unit Projects
Observe See activity, resource use, and AI consumption Audit page, Insights, AI Gateway routing
Scale Repeat for more users, teams, and workloads Every step above, without a new deployment architecture

Attended and unattended work

A workload runs in one of two ways:
  • Attended. A person works alongside the agent or application in their workspace, as a developer does with a coding agent or a business user does in a chat.
  • Unattended. A pipeline, an orchestrator, or an agent platform starts the work and collects the result, with no person in the workspace.
Today, unattended workloads use workspaces created in advance. The work is started either through the REST API or by an orchestration layer that the agentic application provides itself. Run AI coding agents in workspaces describes how to isolate unattended runs and decide what they can reach.

How people and systems reach a workload

What a workload exposes depends on who uses it. Developers work in the Cloud IDE or a local IDE over SSH. Business users open an application through a custom access item. Pipelines and agent platforms use the REST API. To compare the options and choose one, see Choose how users reach a workload.

SecurSpaces within the Citrix platform

SecurSpaces is where agents run. The broader Citrix platform secures and connects everything around it:
  • User access. Citrix Secure Access™ with Chrome Enterprise Premium applies browser and data loss policies. Citrix SecurAccess ZTNA provides zero-trust access to private applications and services. Citrix SecurAccess ZTNA is the new name for Citrix Secure Private Access™ (SPA). See Layered controls with the Citrix platform.
  • AI models. NetScaler® AI Gateway provides governed access to multiple AI models. See AI Gateway routing.
  • MCP servers. Workloads in a workspace can use Model Context Protocol (MCP) servers. SecurSpaces does not manage access to them itself. Govern that access with NetScaler as an MCP Gateway or with Citrix SecurAccess ZTNA.

Deploy it your way

SecurSpaces is available in two models, and agentic workloads run the same way in both:
  • Self-hosted, on your own Kubernetes cluster, in the cloud, on-premises, or air-gapped. See Deploy.
  • SecurSpaces Flex, managed by Citrix on Azure. See SecurSpaces Flex.