Security & compliance

Open Settings, then Security & compliance. Only workspace admins who are not paused can use this page. Root enables each security section for your workspace.

1. Use Feature access to choose who gets a feature that is already enabled for your workspace.
2. Under Members, search by name and press Add. Press Remove to take access away.
3. Choose New members get access to give the feature to people who join later.
4. If your workspace uses Digital Dark, confirm Remove access or press Cancel. Their runs in progress will be cancelled when access is removed.
5. Read Activity to see who changed settings and when. Use Download CSV to save the history. Older activity shows the next page.

Models sets the allowed providers and models for the whole workspace. Root's built-in tools remain available. Feature access does not switch a workspace feature on or off.

Under Allowed models, choose Any model, Only these, or All except these. Select individual models or Every model from a provider, then press Save model rules. Only these keeps new models unavailable until you add them. All except these allows new models unless you block their provider.

Sign-in sets two-step sign-in and enterprise membership rules. Clerk handles SSO through your identity provider. Root checks workspace access and named outsiders, who must use two-step sign-in.

Require two-step sign-in for everyone sets the workspace default. For each member, Two-step sign-in can Use workspace setting, Always require, or Don't require. Enterprise access can Use workspace setting or Require enterprise membership. Allow without SSO (requires MFA) approves an outsider and always requires their two-step sign-in. Press Save for that member, or Remove to remove their workspace membership.

Enterprise members and approved outsiders only restricts workspace access after setup. Manage enterprise connection in Clerk opens your organization settings. Your identity provider manages MFA for enterprise members. MCP checks approved outsiders' MFA enrollment, but cannot verify a fresh browser second factor. Workspace API keys have separate permissions.

Enterprise SSO and directory setup must be tested before employees are onboarded. Your IT admin manages the connection in Clerk. Turning off a Root security section does not turn off Clerk SSO.

Activity includes workspace changes and staff support access. Use View change to compare Before and After. It keeps the previous and new values. Root records a support sign-in once per session in each workspace.