Skip to main content
This page collects recommendations for running Archil in production — how to structure accounts, disks, and credentials so that workloads and tenants stay isolated, and billing stays manageable as you scale.

​
Use a disk as your unit of isolation

A disk is Archil’s unit of access isolation. Credentials — whether disk tokens or IAM authorization — are scoped to an entire disk, including all of its branches and checkpoints. Anyone who can mount a disk can read everything on it, and POSIX permissions are not a security boundary between untrusted users. So when you need to keep workloads or customers from accessing each other’s data:
  • Give each tenant its own disk (or set of disks) rather than sharing one disk across tenants, and issue per-tenant, disk-scoped disk tokens.
  • Don’t use branches as a security boundary. A branch is an alternate history of the same disk, not an isolated disk — it shares the parent disk’s credentials.
  • Don’t rely on POSIX permissions to separate untrusted tenants on a shared disk.

​
Give each agent or job its own fork

For AI-agent and CI fan-out workloads, run each agent or job against its own writable branch — or its own disk when the work is untrusted. Branches are copy-on-write and fully independent: each can be mounted on a different VM, writes are isolated from the parent and siblings, and you’re only billed for the unique data each fork adds (see Metering). This gives every agent a clean, isolated working copy without duplicating the base data set. When forks must be isolated from each other for security — for example, one end customer per fork — give each its own disk instead, since a branch shares the parent disk’s credentials.

​
Structure accounts and billing

Use organizations to group disks by team or environment and to keep billing separate from personal usage. A common setup is a separate Dev and Production organization, so experimental disks and credentials stay isolated from production data and you can manage access and billing for each independently. If you operate Archil on behalf of your own customers, you can likewise map multiple Archil organizations to your internal boundaries: multiple organizations can be billed under a single contract, so splitting work across organizations — whether by environment or by tenant — doesn’t fragment your billing. Contact us to set up a single contract across multiple organizations.