Everyone builds with AI. Engineers decide what ships.

Yes. Business teams build scripts, flows and apps with AI in a workspace fork or a dev workspace. A protection ruleset blocks direct deployment to the shared or prod workspace, so a change only reaches it after an engineer reviews the diff and deploys it. Their jobs can run on dedicated workers, or on a separate Windmill instance.

Yes. Windmill is open-source and runs on your own infrastructure with Docker or Kubernetes, from a single VPS to large clusters. Code built with AI runs on your workers, in your network, and the AI calls the model providers you configure.

You bring your own provider: OpenAI, Azure OpenAI, Anthropic, Mistral, DeepSeek, Google Gemini, Groq, OpenRouter, Together AI, AWS Bedrock, or any OpenAI-compatible endpoint such as a local Ollama server. Providers are configured per workspace or for the whole instance.

The AI acts with the permissions of the person using it, so it reaches only the folders, resources and variables that person can read. Keep production credentials out of the folders business teams can read, and give them a dev workspace with its own credentials. A member with read access to a variable can read its value through the API, so scope access with folders rather than roles.

No. Members with a Compose role assemble flows and apps from scripts and flows engineers already deployed, without code of their own. Building in AI sessions, where the AI writes code, requires the Write code capability; those members are protected by forks, review and dedicated workers rather than by their role.

Yes. Engineers write scripts in 20+ languages, develop locally with the Windmill CLI, VS Code extension and coding agents such as Claude Code, and sync workspaces with Git. What business teams build lands in the same workspaces and goes through the same review and promotion.

Protection rulesets, custom workspace roles, locking a prod workspace, per-item deploy between workspaces and to another instance, Git promotion and full audit logs require Enterprise. Forks and dev workspaces are available on every self-hosted edition, within the Community Edition limit of 3 workspaces, forks included.

A member whose role can write code or build flows or apps, at the Compose or Full level, counts as a full seat. A member who only runs and views what others built counts as half a seat.