# Environments > An environment is a named partition of your org, such as Sandbox or Production, with its own agents, connections and API keys. **Skill for your coding agent:** [`mindset-mcp/SKILL.md`](https://docs.mindset.ai/skills/mindset-mcp/SKILL.md) Builders work from a coding agent and operators from an AI client, both through the MCP server, or in the Studio. In Mindset, an agent is a prompt and a model, held to an order by a script when needed. It uses connections to outside systems, operations on them, functions and widgets. Every change is a version, and every execution is a run. Every piece sits on one security and compliance layer: the org sets its posture once, and every agent works under it, with the audit trail and, once an admin turns it on, personal data redaction. The platform runs in your own cloud (AWS, GCP or Azure) or is hosted by Mindset. Your app reaches agents through the SDK, your server through the API, and people through the Hub and schedules. An **environment** is a named partition inside your org, such as Sandbox, Test or Production. Everything built in one environment belongs to it and can't see anything in another. Every org starts with exactly one, named **Sandbox**, with the address `original`. Add another to try changes against test systems, apart from the agents people rely on. ## Why it matters You can change an agent without putting the live one at risk. Build and test against test systems, and nothing you do there can read a real invoice or send a real supplier query. An API key only works in its own environment, so a leaked Sandbox key can't reach Production. ## What each one holds | Lives inside one environment | Shared by the whole org | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------ | | Agents and their versions, scripts, functions and widgets | Members and their roles | | Connections, their operations and their credentials | The list of environments itself | | Each operation's tested status, and the write go-aheads given for test runs | [Org settings](https://docs.mindset.ai/docs/org-settings), including the write operation switch | | Test parameters, behavior tests and experiments | Model keys, embedding keys and the keys for the built-in agents | | Triggers, schedules, conversations and runs | The audit record | | Cost records | | | API keys, and the **Allowed websites** list for embedded sign-in | | > **Info:** Org settings and the audit record belong to the org, so Sandbox and Production run under the same [compliance rules](https://docs.mindset.ai/docs/compliance). The connections make two environments different. If Test's finance connection holds the credentials for your test finance system, the invoice exceptions agent built in Test can't read a real invoice or send a real supplier query, whatever its instructions say. ## Moving work between environments Nothing is copied between environments, and there is no promote step. Make the change again in the next environment once it holds up. | What | Across environments | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Operation approvals | Approving "send supplier query" in Test doesn't approve it in Production | | Tested status | Kept per environment. A script or function rebuilt in Production can't go live until its operations have run successfully there, or an admin chooses **Go live untested**. See [the go-live gate](https://docs.mindset.ai/docs/versions-and-going-live#the-go-live-gate) | | The write operation switch | Org-wide, so you can't hold new write operations for approval in Production only. See [Security and approval](https://docs.mindset.ai/docs/security-model) | Webhook and MCP addresses (`…/orgs//envs//mcp`) name the environment, so a delivery or a client always lands in the one it was set up for. The Studio works in the one chosen in the **Environment** switcher in the left navigation. ## Members and API keys Membership is access to every environment. A member's role is the same in all of them, and you can't invite someone into Test only. An API key works only in the environment it was created in, and a call that names another environment is refused. The key is shown once, when it's created. > **Danger:** Keys are admin-grade. Keep each one in a secret manager, never in a browser, and give it one named owner who knows what uses it. ## Names and addresses Only admins can create or rename an environment. Mindset derives the address from the name and adds a number if it's taken, so a second "Test" gets `test-2`. Renaming changes only the name people see, so every address keeps working. An environment can't be deleted. To create environments and API keys, see [Roll out Mindset](https://docs.mindset.ai/docs/roll-out-mindset).