How Knowledge Worker Agent works
Knowledge Worker Agent is a chat assistant that does real work in your SecurSpaces workspace. It reads and writes files, runs commands, and uses the services you connect. This page explains where that work happens, what the assistant is allowed to do, and what that means for your data.
An assistant in your workspace
Most chat assistants run on someone else's servers, and you bring files to them. Knowledge Worker Agent runs inside your own Citrix SecurSpaces™ workspace, next to your files.
Each chat runs opencode, an open-source coding agent, in the chat's folder. The assistant works the way a colleague at your keyboard would. It opens files, writes new ones, and runs commands, and the results stay in the folder where you can see them. That's why every chat has a folder, and why the Files panel sits beside the chat.
The model that writes the answers runs at your model provider, such as GitHub Copilot or Google Vertex AI. What the assistant sends there is the conversation, and whatever it reads to answer you. Connectors reach the services they connect to. Dictation is the exception: speech is turned into text inside the workspace, and no audio leaves it.
Why it needs SecurSpaces
Knowledge Worker Agent relies on the SecurSpaces platform for things it doesn't do itself:
-
Access control: Knowledge Worker Agent has no sign-in of its own. The platform decides who can reach the workspace, and the security model depends on that.
-
Sharing: shared chats and shared files are published through the platform's workspace apps, and the platform decides who can open them.
-
Keeping the workspace running: while the assistant works, Knowledge Worker Agent tells the platform the workspace is active, so it isn't stopped halfway through a task.
-
Git access: tokens for Git providers are set up in SecurSpaces, not in Knowledge Worker Agent.
-
Your identity: the platform tells Knowledge Worker Agent the owner's name, so the assistant knows who it works for.
What the assistant can do
The assistant acts without asking. It can read and change any file your workspace user can, and run any command. This is deliberate. The value of an agent is that it finishes a task while you do something else. A workspace that belongs to one person limits what it can reach.
Agents can carry their own permissions. For example, an agent may be allowed to read files but not to run commands. An agent can't be set to ask you before it acts.
Scheduled tasks act while you aren't there. Choose their prompts with that in mind.
The Files panel reaches less far. It opens any file in your home folder, not only the files in a chat's folder, but not the hidden folders and files directly in it, such as
.ssh and .config, where keys and tokens are kept. A chat's folder is in your home folder too.
What it installs
Knowledge Worker Agent installs a fixed version of opencode, and checks the download against a known checksum before using it. An update to opencode therefore arrives only with a new release of Knowledge Worker Agent, not on its own.
Open source
Knowledge Worker Agent is open source, under the Apache License 2.0. The source is on GitHub at strong-network/Knowledge-Worker-Agent, so your security team can review what it does before you roll it out.
A tool for one person
Knowledge Worker Agent is built for a single user in an isolated workspace. It doesn't check who is calling it, because the platform already has. Anyone who can reach its port can use it as you.
This is why it must never be exposed outside the workspace. Run it only where the platform keeps its port private to the workspace's owner. It listens only inside the workspace, where the platform connects, and refuses a change that a browser sends from another website, so a page you have open elsewhere can't act through it. Chat sharing doesn't change this: guests reach a separate, restricted surface, not the owner's.
Where your chats live
Chats, messages, and settings are stored in a database in your workspace. Files stay in their chat or project folders. Credentials are stored in your workspace too. For the exact locations, see Storage locations.