This is our Data Loss Prevention (DLP) feature working as intended. To protect intellectual property, tenant administrators can restrict the ability to copy code out of the environment.

If you believe you need this access, please contact your Tenant Admin. They can enable copy/paste for your role via Role Permissions → can_copy_paste.

All clipboard attempts (allowed or blocked) are logged in the activity feed for audit purposes.

The Panopticon monitors active typing and IDE focus. It aggregates keystrokes into "Active Sessions." If a developer is idle for too long, the session pauses automatically.

Payroll uses these mathematically verified "Active Hours" rather than manual timesheets. Timesheets are accessible from Workspaces → Payroll.

Admins review and approve timesheets before export.

The Vault allows administrators to store sensitive environment variables (API keys, database credentials, tokens) that are injected into the IDE session without exposing them to developers.

• Secrets are encrypted at rest (AES-256).
• Developers cannot view secret values — they can only use them in code.
• Secrets are never written to the file system or logged.

Set up via Workspaces → Select Project → Settings → Vault.

The AI Copilot in Nexus answers questions using the selected file context. It requires a workspace OpenAI API key, configured by a workspace administrator in AI Settings.

• Bring your own key: The key is encrypted at rest.
• Context: The question and selected file context are sent to OpenAI using that key.
• Privacy: Do not paste secrets, personal data or sensitive production data into prompts.

Without a configured key, Copilot runs in offline mode.

Sentinel runs a local credential and security-pattern scan on merge request diffs. It looks for common credential markers and high-risk patterns, then records a security flag and confidence score on the request.

It is a fast first-pass check, not a model-backed AI code review. Human review, testing and security assessment are still required before merging.