Access Control

The Access Control screen shows, per workload identity, which other identities it is allowed to connect to and from over mTLS. It is an allowlist of service-to-service connections.

Open it from Configure → Access Control in the sidebar (/ui/access-control).

Note

This screen governs connections between your workloads. To restrict which models and tools an AI agent may use, see the separate Access Control screen under Agentic.

What you see

A read-only overview table with these columns:

• Workload ID: the workload identity.
• Allowed Inbound Workload IDs: the identities allowed to connect to it.
• Allowed Outbound Workload IDs: the identities it is allowed to connect out to.

When a direction has no entries, the row shows All connections allowed for it. Search by workload ID.

The rule is an allowlist: an empty list in a direction means all connections are allowed that way, and listing identities restricts it to exactly those. So a workload is unrestricted until you add entries.

Changing the rules

This screen is an overview. To change what an identity allows, click its Workload ID to open the identity, choose Edit, and use the Access Policy tab to set the allowed Inbound and Outbound identities. Finer, per-destination or per-port rules live on that identity’s Egress and Ingress rules. See Identities for the full form.

Next steps

• Connection Security: how mTLS is established between workloads.
• Implicit mTLS: when connections are secured without an explicit rule.
• Identities: where these allowlists are edited.