How OpenWork Den Provides an Organization Control Plane for Team Management

OpenWork Den serves as a centralized backend control plane that unifies team management, access rights, and policy enforcement across all OpenWork surfaces through a secure API gateway and real-time synchronization.

OpenWork Den functions as the authoritative backend layer within the different-ai/openwork repository, providing a comprehensive organization control plane for managing teams at scale. This system powers organization-wide features including user provisioning, access control, and resource management across the desktop application, cloud gateway, and MCP integrations.

Centralized Data Architecture

At the foundation of the organization control plane lies a centralized relational database that stores core organizational objects. Den maintains versioned records for organizations, members, teams, connections, policies, and product-level settings, all linked via stable identifiers.

The data schemas are strictly defined in packages/types/src/den/organization.ts and packages/types/src/den/team.ts, ensuring type safety across the entire stack. This centralization guarantees that every surface—whether the desktop client, cloud gateway, or MCP integration—queries the same source of truth for team management operations.

Secure API Gateway and Authentication

The den-gateway service exposes a versioned HTTP API (/v1/*) that serves as the entry point for all organization management requests. Located in ee/apps/den-gateway/src/app.ts, this HTTP server implements policy middleware that validates every incoming request.

Authentication relies on signed JWTs that carry the user's organization-member ID. The verifyJwt function in ee/apps/den-api/src/auth.ts validates these tokens, ensuring only authorized users can act on behalf of a given organization. This security model prevents unauthorized access to team management endpoints while enabling seamless cross-service communication.

Policy Enforcement Engine

Every request traversing the organization control plane passes through a policy engine that evaluates organization-level flags. Defined in packages/types/src/den/desktop-policies.ts, these flags control feature availability such as "disable custom providers" or "enforce Alpha updates."

The policy engine determines whether specific tools remain enabled for teams and whether requested changes may persist to the database. This centralized enforcement ensures consistent security posture across all client surfaces without requiring individual application updates.

Team Management and Access Control

OpenWork Den provides comprehensive endpoints for team lifecycle management within the organization control plane. Administrators can create teams, invite members, assign roles (admin, member, owner), and manage SCIM-based synchronization with external identity providers.

These operations map internally to database tables including organizations, members, team_members, and roles. The SCIM implementation in ee/apps/den-controller/src/scim.ts enables automated user provisioning from enterprise identity providers, while the entry point in ee/apps/den-api/src/index.ts exposes RESTful endpoints for manual team administration.

Extension and Plugin Registry

Den hosts a registry of connections comprising plugins, providers, and capabilities scoped to individual organizations. Administrators enable or disable specific connections through the organization control plane, with changes immediately propagating to desktop and cloud clients via the policy engine.

This registry architecture allows organizations to customize their OpenWork deployment by selectively activating only approved tools and integrations, maintaining security while providing flexibility.

Real-Time Synchronization

The organization control plane maintains consistency across distributed clients through change-feeds delivered via websockets or long-polling. When administrators update policies or team structures, Den emits change notifications that push immediately to active sessions.

The emitChange function broadcasts updates to all subscribed clients, ensuring that desktop applications, web dashboards, and MCP gateways adjust their UI state instantly without requiring manual refresh or polling intervals.

Observability and Audit Logging

All management actions within the organization control plane are captured in the Den audit log. The implementation in ee/apps/den-gateway/src/audit.ts records every significant operation, providing administrators with a complete history of organizational changes.

Administrators can query these records via the GET /v1/organizations/:id/audit endpoint, enabling compliance monitoring and security forensics. This audit trail captures who changed what and when, essential for enterprise team management requirements.

Example: Updating Organization Policies

The following TypeScript example demonstrates how the organization control plane handles policy updates. This simplified snippet from the policy middleware shows the authentication check, database update, and real-time notification flow:

// Example: an admin toggles the "tools enabled for your organization" flag.
// This is a simplified snippet taken from the policy middleware.

import { verifyJwt } from './auth';
import { updateOrganizationPolicy } from './db';
import { emitChange } from './sync';

export async function setToolEnabled(req, res) {
  const { orgId, enabled } = req.body;
  const user = await verifyJwt(req.headers.authorization);
  if (!user.isOrgAdmin(orgId)) {
    return res.status(403).json({ error: 'Insufficient permissions' });
  }

  // Persist the change
  await updateOrganizationPolicy(orgId, { toolsEnabled: enabled });

  // Push the change to all active sessions
  emitChange(orgId, { type: 'policyUpdate', payload: { toolsEnabled: enabled } });

  res.json({ success: true });
}

When this endpoint executes, the Den backend writes the new flag to the database, logs the administrative action, and broadcasts the update so that desktop clients instantly reflect the modified policy.

Summary

OpenWork Den delivers a robust organization control plane for team management through the following key mechanisms:

• Centralized data model that maintains consistent organizational state across all client surfaces
• JWT-based authentication verifying organization-member claims before processing management requests
• Policy engine enforcing organization-wide feature flags and security constraints
• Real-time synchronization ensuring immediate propagation of team and policy changes
• Comprehensive audit logging capturing every administrative action for compliance and security review

Frequently Asked Questions

What defines OpenWork Den as an organization control plane?

OpenWork Den functions as the authoritative backend layer that centralizes all data regarding organizations, teams, members, and policies. According to the different-ai/openwork source code, it exposes secure APIs, enforces access controls, and synchronizes state across desktop applications, cloud gateways, and MCP integrations, providing unified team management capabilities.

How does authentication secure team management operations?

The system uses signed JWTs containing organization-member IDs to authenticate requests. The verifyJwt function in ee/apps/den-api/src/auth.ts validates these tokens, ensuring that users possess appropriate administrative privileges before executing team management actions such as inviting members or modifying policies.

How are policy changes propagated to client applications?

When administrators update policies through the organization control plane, the emitChange function broadcasts updates via websockets or long-polling mechanisms. This real-time synchronization ensures that desktop clients, web dashboards, and MCP gateways instantly reflect policy changes without requiring manual refresh or polling intervals.

What audit capabilities support compliance requirements?

OpenWork Den records every management action to a comprehensive audit log implemented in ee/apps/den-gateway/src/audit.ts. Administrators can query this history via the GET /v1/organizations/:id/audit endpoint, providing complete visibility into who changed organizational settings and when, satisfying enterprise compliance and security forensics requirements.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}