When a user is suspended, their API key is invalidated and they cannot establish any new connections. However, if a user happens to have an active SSH connection, they can remain in their workspace to download files, access network resources, etc.

It seems like are two ways this could work, both are fine with me:

• Disconnect all open connections from the user (including direct peer-to-peer connections)
• Stop the workspace, which will inherently disconnect all connections.