Systems and methods for continuous evaluation of workspace definitions using endpoint context

1. An Information Handling System (IHS) of a workspace orchestration service, comprising:

a processor; and

a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to:

receive context information from a local management agent of a client device;

determine that a current workspace provided via the local management agent is over-privileged, at least in part, by (i) calculating a productivity score using the context information, and (ii) determining that the productivity score is greater than a productivity target associated with a current workspace definition;

in response to the determination, modify the current workspace definition into a modified workspace definition, wherein the modified workspace definition outlines fewer resources than the current workspace definition; and

transmit, to the local management agent, data configured to enable the local management agent to modify the current workspace based upon the modified workspace definition to reduce a number of resources available to a user of the client device.

2. The IHS of claim 1 , wherein the context information comprises an identification of a locale of the client device, an identification of an application executed or installed in the current workspace, an identification of the user of the client device, an identification of a network of the client device, an identification of hardware of a client device, an identification of a requested datafile, or an identification of a storage system of the requested datafile.

3. The method of claim 1 , wherein to determine that the context information indicates that the current workspace is over-privileged, the program instructions, upon execution, further cause the IHS to:

calculate a security risk score based upon the context information; and

determine that the security risk score is greater than a security target associated with the current workspace definition.

4. The IHS of claim 3 , wherein the program instructions, upon execution, further cause the IHS to determine that the security risk score is greater than the security target by a threshold value, and wherein the threshold value is an attribute of the current workspace definition.

5. The IHS of claim 3 , wherein to calculate the security risk score, the program instructions, upon execution, further cause the IHS to combine two or more of: a risk metric associated with a locale of the client device, a risk metric associated with a user of the client device, a risk metric associated with a network of the client device, a risk metric associated with hardware of a client device, a risk metric associated with a requested datafile, or a regulatory risk metric associated with the user, the locale, and the requested datafile.

6. The IHS of claim 1 , wherein the program instructions, upon execution, further cause the IHS to determine that the productivity score is greater than the productivity target by a threshold value, and wherein the threshold value is an attribute of the current workspace definition.

7. The IHS of claim 1 , wherein to calculate the productivity score, the program instructions, upon execution, further cause the IHS to combine two or more of: a resource metric associated with a locale of the client device, a resource metric associated with a user of the client device, a resource metric associated with a network of the client device, a resource metric associated with hardware of the client device, or a resource metric associated with a storage system of a requested datafile.

8. The IHS of claim 1 , wherein to reduce the number of resources available to the user of the client device, the program instructions, upon execution, further cause the IHS to perform at least one of: reduce a number of executable applications available, reduce a number of hardware features available, restrict network access options, or reduce a level of data access.

9. A memory storage device having program instructions stored thereon that, upon execution by one or more processors of an Information Handling System (IHS) of a workspace orchestration service, cause the IHS to:

receive context information from a local management agent of a client device;

in response to the context information indicating that a current workspace provided via the local management agent is over-constrained, modify a current workspace definition into a modified workspace definition, wherein the modified workspace definition outlines more resources than the current workspace definition, and wherein to determine that the context information indicates that the current workspace is over-constrained, the program instructions, upon execution, further cause the IHS to:

(i) calculate, using the context information, a user frustration score based upon at least one of: a number of repeated clicks on a same area of a display during a selected time period, a number of repeated keystrokes during the selected time interval, a number of simultaneous keystrokes, a magnitude of a mechanical impact event, a lid of the client device being shut, or changes to a distance between the user and the client device; and

(ii) determine that the user frustration score meets or exceeds a threshold value; and

transmit, to the local management agent, data configured to enable the local management agent to modify the current workspace based upon the modified workspace definition to increase a number of resources available to a user of the client device.

10. The memory storage device of claim 9 , wherein the context information comprises an identification of a locale of the client device, an identification of an application executed or installed in the current workspace, an identification of the user of the client device, an identification of a network of the client device, an identification of hardware of a client device, an identification of a requested datafile, or an identification of a storage system of the requested datafile.

11. The memory storage device of claim 9 , wherein to determine that the context information indicates that the current workspace is over-constrained, the program instructions, upon execution, further cause the IHS to:

calculate a productivity score using the context information; and

determine that the productivity score is smaller than a productivity target associated with the current workspace definition.

12. The memory storage device of claim 11 , wherein the program instructions, upon execution, further cause the IHS to determine that the productivity score is smaller than the productivity target by a threshold value, and wherein the threshold value is an attribute of the current workspace definition.

13. The memory storage device of claim 11 , wherein to calculate the productivity score, the program instructions, upon execution, further cause the IHS to combine two or more of: a resource metric associated with a locale of the client device, a resource metric associated with a user of the client device, a resource metric associated with a network of the client device, a resource metric associated with hardware of the client device, or a resource metric associated with a storage system of a requested datafile.

14. The memory storage device of claim 9 , wherein to determine that the context information indicates that the current workspace is over-constrained, the program instructions, upon execution, further cause the IHS to:

calculate a security risk score using the context information; and

determine that the security risk score is smaller than a security target associated with the current workspace definition.

15. The memory storage device of claim 14 , wherein the program instructions, upon execution, further cause the IHS to determine that the security risk score is smaller than the security target by a threshold value, and wherein the threshold value is an attribute of the current workspace definition.

16. The memory storage device of claim 14 , wherein to calculate the security risk score, the program instructions, upon execution, further cause the IHS to combine two or more of: a risk metric associated with a locale of the client device, a risk metric associated with a user of the client device, a risk metric associated with a network of the client device, a risk metric associated with hardware of a client device, a risk metric associated with a requested datafile, or a regulatory risk metric associated with the user, the locale, and the requested datafile.

17. The memory storage device of claim 9 , wherein to increase the number of resources available to the user of the client device, the program instructions, upon execution, further cause the IHS to perform at least one of: increase a number of executable applications available, increase a number of hardware features available, increase network access options, or increase a level of data access.

18. A method performed by one or more Information Handling Systems (IHSs), the method comprising:

receiving, by the one or more IHSs, context information from a local management agent of a client device;

in response to the context information indicating that a current workspace provided via the local management agent is over-constrained, modifying, by the one or more IHSs a current workspace definition into a modified workspace definition, wherein the modified workspace definition outlines more resources than the current workspace definition, and wherein determining that the context information indicates that the current workspace is over-constrained further comprises:

(i) calculating a security risk score using the context information; and

(ii) determining that the security risk score is smaller than a security target associated with the current workspace definition; and

transmitting, from the one or more IHSs to the local management agent, data configured to enable the local management agent to modify the current workspace based upon the modified workspace definition to increase a number of resources available to a user of the client device.

19. The method of claim 18 , further comprising determining that the security risk score is smaller than the security target by a threshold value, and wherein the threshold value is an attribute of the current workspace definition.

20. The method of claim 18 , wherein calculating the security risk score further comprises combining two or more of: a risk metric associated with a locale of the client device, a risk metric associated with a user of the client device, a risk metric associated with a network of the client device, a risk metric associated with hardware of a client device, a risk metric associated with a requested datafile, or a regulatory risk metric associated with the user, the locale, or the requested datafile.

21. The method of claim 18 , wherein determining that the context information indicates that the current workspace is over-constrained further comprises at least one of:

calculating a productivity score using the context information and determining that the productivity score is smaller than a productivity target associated with the current workspace definition; or

calculating a security risk score using the context information and determining that the security risk score is smaller than a security target associated with the current workspace definition.