WORKSTATION AGENT
Workstation Agent — Permissions & Resource Access
8 of 12Control local resource access with explicit tenant policy, user consent, connector scopes, least privilege and revocation.
Least-PrivilegeUser ConsentAuditableRevocableTenant Controlled
The permission chain
1
Tenant Policy
Organization defines allowed resource types and rules.
2
Workstation Trust
Workstation is registered and trusted.
3
User / Session
Authenticated user with roles and MFA.
4
Connector Scopes
Connector declares required resources and permissions.
5
Resource Binding
Resources are bound to connector scope.
6
Runtime Consent
User consents when required.
7
Access Granted
Connector accesses only bound resources.
8
Audit & Revoke
All access is logged and can be revoked.
No connector can access any resource without passing through the entire permission chain.
Resource types
USB / HID devices — microphones, foot pedals, cameras
Serial / COM ports — lab equipment, scales, monitors
Bluetooth devices
Smart-card readers and identity devices
Local applications
Files & folders
Printers
Network endpoints
Vendor SDKs / drivers
Permission model
| Level | Description | Example |
|---|---|---|
| Tenant Policy | Globally allowed resource types | Allow USB; deny file system by default |
| Workstation | Machine trust & patch state | Trusted = yes |
| User / Session | Auth, roles, MFA | Role: Physician |
| Connector Scope | Connector declared needs | audio:mic, audio:stream |
| Resource Binding | Specific device bound | USB VID/PID |
| Runtime Consent | Prompt on sensitive access | First-time access |
| Access | Least-privilege token | TTL 15 min |
| Audit & Revocation | Logged and revocable | Revoke on logout |
Access control rules
Default deny for all resources
Connectors receive only explicitly requested resources
Resource access is non-transferable between connectors
Permissions can be time-limited
High-risk actions require user consent or MFA step-up
Immediate revocation is enforced
All access is auditable and traceable
jsonCopy
{
"connectorId":"dictation-mic",
"resources":[
{"type":"audioDevice","deviceId":"USB\VID_0B0E...","access":"read","purpose":"capture-audio"}
],
"expiresIn":"15m"
}User consent experience
Dictation Microphone
Connector wants to access your microphone and foot pedal.
Revocation & limitations
Revoke now — immediately stop connector and close streams
Limit access — change resource scope
Expire access — automatic expiry after time limit
Revoke on logout — remove session access
Administrator controls
Global policies
Connector allowlist
Resource allowlist / denylist
Approval workflows
Audit & compliance export