Unmanaged devices do not need an all-or-nothing policy. A secure enterprise workspace can grant a reduced capability set based on identity assurance, device posture, data class, action risk, location, and session state.
Risk-tiered access
| Tier | Example access | Controls |
|---|---|---|
| View | Low-sensitivity dashboards and approved outputs. | Phishing-resistant sign-in where required, short session, watermark, no secret display. |
| Interact | Run bounded agents using assigned read-only tools. | Step-up authentication, tenant checks, content policy, rate and budget limits. |
| Change | Execute external writes or approve high-impact actions. | Managed device or approved virtual workspace, bound approval, fresh authentication. |
| Administer | Change roles, integrations, policies, or retention. | Managed privileged workstation, separate admin identity, enhanced monitoring. |
Browser and session controls
Use secure, HTTP-only cookies; prevent tokens in local storage where possible; bind sessions to risk signals; rotate on privilege change; expire idle and absolute lifetimes; and revoke centrally. Do not treat user-agent strings as trustworthy device posture.
Data movement
Control downloads, print, clipboard, copy/paste, uploads, browser extensions, webhooks, email, and connector exports according to data class. When controls cannot prevent capture, reduce exposed data, watermark it, and record access for investigation.
External users
Use a sponsor, explicit workspace membership, expiry, restricted role, allowed domains, and periodic recertification. Remove access when the engagement ends and preserve the membership and export history required by policy.
Map an external-collaboration workspace to BlueBear roles and action policies.