Rye supervision workbench
Device login
Authenticate a developer workstation so Rye can attribute supervised AI activity to a user, workspace, and device.
Login flow
Run:
rye auth login
Rye starts a device-code login flow. After the user completes the browser step, the local CLI receives workspace credentials and the device becomes known to Rye.
Why device identity matters
Device identity gives audit records a stable local anchor. A useful record should answer:
- Which user started the agent?
- Which workspace policy was active?
- Which device ran the session?
- Which local tool was supervised?
- Which policy allowed, redacted, or blocked the request?
Revocation model
When a machine should no longer run supervised AI tools, revoke the device from the workspace. Future requests from that device should be denied even if a local agent still has model-provider credentials in its environment.
Session attribution
Authentication is also how Rye connects local traffic to app-side records. Without device login, a proxy may still see network traffic, but the audit trail is missing the user and workspace context security teams need.