I'm looking for advice from people who have experience both with U.S. federal software environments and with Whole Team Development, ensemble programming, or mob programming in that setting. I'm especially interested in tooling, access requirements, credentials, and security controls.
What tools have you successfully used for screen sharing and transferring keyboard or mouse control—for example, an approved version of Microsoft Teams or Webex, a shared VM or VDI, VS Code Live Share, JetBrains Code With Me, or a self-hosted collaboration platform? Were there initial concerns from security or other approval groups, and what controls or documentation helped address them?
I'm particularly interested in situations where individual credentials must remain separate for activities such as promotion, production access, or administration. Examples from different federal agencies or security levels would be helpful, since I understand the requirements can vary considerably.
3 Answers
The safest approach is usually a self-hosted or agency-approved collaboration platform reviewed by the system security officer. Keep the IDE and filesystem on a controlled shared server or VDI, with auditing and access controls applied there, rather than sending sensitive code or data through an external screen-sharing service. Each person should authenticate with their own account, and the setup should prevent anyone from using another person’s credentials.
Start by documenting the intended workflow and asking the security or authorization team to evaluate that specific design. Explain exactly what will be shared, where the code and files live, whether clipboard or file transfer is enabled, how sessions are logged, and how individual actions remain attributable. A locked-down shared VM or VDI inside the approved network is often easier to justify than a browser-based service connected to an external cloud.
Security teams may initially reject broad requests for remote-control or screen-sharing tools, but a narrowly scoped, internally hosted setup with clear data-flow diagrams and compensating controls gives them something concrete to review.
There isn’t one universal federal answer. Requirements differ substantially between agencies, projects, authorization boundaries, and data classifications. A collaboration tool approved for one agency or environment may be prohibited in another. Government-hosted versions of common tools may be acceptable, while third-party services or tools that access sensitive data often require a separate review or may not be allowed at all.
The key questions are where the data resides, whether the service leaves the agency-controlled network, what the provider can access, and whether the tool is covered by the environment’s authorization and security documentation.
That distinction matters most for production, administrative, and promotion activities. Collaborative editing can be shared, but actions requiring individual accountability still need to be performed by the person whose credentials are being audited.