Environments

Rekor workspaces support two environments: production and preview. Agents experiment freely in preview workspaces, and a human operator promotes validated config to production.

How It Works

1. Production workspace — the live environment. Agents can read everything and write records, but cannot change the schema (collections, triggers, hooks).
2. Preview workspace — a sandbox linked to a production workspace. Agents have full access: modify schemas, create test records, configure triggers.
3. Promote — a human-only operation that copies config from preview to production after review. Records stay in preview.

Access Control

Operation	Production	Preview
Read collections, records, relationships	Yes	Yes
Write records and relationships	Yes	Yes
Upsert/delete collections	No	Yes
Create/delete triggers and hooks	No	Yes
Promote	Human only (CLI)	N/A

Workflow

1. Create a preview workspace

rekor workspaces create-preview my-workspace --name "add-invoices"

2. Agent works in preview

# Add a new collection
rekor collections upsert invoices \
  --workspace my-workspace--add-invoices \
  --schema '{"type":"object","properties":{"amount":{"type":"number"},"status":{"type":"string"}}}'

# Test with sample records
rekor records upsert invoices \
  --workspace my-workspace--add-invoices \
  --data '{"amount": 5000, "status": "draft"}'

3. Review and promote (human)

# See what would change
rekor workspaces promote my-workspace \
  --from my-workspace--add-invoices --dry-run

# Apply
rekor workspaces promote my-workspace \
  --from my-workspace--add-invoices

4. Rollback if needed

# List promotions
rekor workspaces promotions my-workspace

# Rollback a specific promotion
rekor workspaces rollback my-workspace --promotion <promotion-id>

What Gets Promoted

Only config is promoted — not data:

• Collections — JSON Schema, display hints, external sources
• Triggers — webhook dispatch rules (new secrets generated on production side)
• Hooks — inbound webhook receivers (new secrets generated)

Records and relationships in the preview workspace are test data and stay behind.

Schema Compatibility

When promoting a modified collection schema, Rekor samples existing production records and validates them against the new schema. Breaking changes (removed required fields, type changes) are flagged before they can be applied.

Multiple Previews

A production workspace can have multiple preview workspaces. Each is independent — different agents or team members can experiment on different features in parallel.