The governed agentic operating system
Put AI agents to work under a ceiling they cannot raise.
Right now your agents draft, summarise and suggest, and a person still does every part that counts — because nobody can say exactly what they are allowed to do alone. Here that is decided before the agent runs: every action carries a risk tier, and the runtime caps unattended agents below anything irreversible. What sits above the cap waits for a named person, and every decision, including every refusal, is on the record.
Five multiple-choice questions. A person replies within one business hour.
- 09:40:44T2record.updateexecuted
reversible · before and after stored
- 09:40:51T1reply.sendexecuted
answer matched approved content
- 09:40:58T3vendor.email.sendrefused
no consent on file · fail closed
- 09:41:02T3refund.issueheld for approval
waiting on a named person
- 09:41:09T4payment.captureheld for approval
two approvers required
- 09:41:15T5policy.ceiling.raiserefused
an agent may not widen its own limits
Try it — no sign-up, no form
Try to make it do something it shouldn’t.
Ten requests, and the verdict changes as fast as you can click. Three of them the agent simply does. Three it prepares in full and then holds for a person. Four are the attacks people actually worry about, including the two that work on other systems: telling it the customer already approved, and telling it to raise its own limit.
Pick a request
The four under Try to get past it are the ones worth your time. They are the attacks people actually worry about.
Ordinary work · 3
Consequential work · 3
Try to get past it · 4
1 of 10 tried
What the runtime does
Held for a named person
Money leaving the business is tier 3. The agent prepared the whole refund — amount, reason, evidence — and then stopped. A person approves it, and the ledger records who.
The rule underneath
The agent does the work. A human makes the decision that cannot be undone.
ledger · T3 · refund.issue · held · recorded
This is a faithful simulation of the policy logic on this page, not a live tenant — we are not going to dress a scripted demo up as production traffic. On a call we run the same requests against a real workspace and show you the events as they are written.
The problem
Everyone has AI that can write. Almost nobody has AI they would let act.
Drafting an email is safe. Sending it is not. Summarising an account is safe. Refunding it is not. The moment an agent stops suggesting and starts doing, someone has to answer a question that no amount of model quality resolves: what stops it?
Today that question gets three unsatisfying answers. Give the agent broad access and keep a log. Wrap every step in a rigid workflow and call the model call an agent. Or buy a second product whose job is to watch the first one. Across the platforms we reviewed in September 2026, we could not find one that answers it on its own pages.
Meanwhile only about one company in five reports a mature way to govern autonomous agents at all, and trust in fully autonomous agents fell from 43% to 27% in a single year. The appetite did not disappear. The permission did.
Sources: Deloitte, State of AI in the Enterprise 2026 (3,235 leaders); Capgemini Research Institute, 2025 (1,500 executives).
The mechanism
Seven rules the agents cannot talk their way around.
Not guardrails in a prompt. Rules in the runtime, which is a different thing entirely — a prompt can be argued with.
- 01
No agent is trusted by default
An agent with no resolved policy can do nothing at all. Identity and permission are checked on every action, not once at login.
- 02
Every action is tiered
Reading is not refunding. Each action carries a risk tier, and the tier — not the agent's confidence — decides what happens next.
- 03
Humans hold the keys to irreversible actions
Unattended agents are capped below anything that publishes, pays, deploys or deletes. Those actions wait for a named person — and a model cannot forge that approval, not even by voice.
- 04
Agents see only the tools they are allowed to use
Tools are filtered by policy before the model ever sees them. A tool that is not on the list cannot be called, however persuasive the prompt.
- 05
Memory advises, never authorises
What the system remembers is labelled as advice and scoped to your workspace. No remembered fact can grant a permission or approve an action, so a planted memory has nothing to unlock.
- 06
No model grades its own work
On supported runs, work is verified by a different model family from the one that produced it, and the run closes only when both the builder's integrator and an independent adversary approve, with evidence attached.
- 07
Everything leaves a trail — including the refusals
Each action writes an event for every way it can end: completed, failed, denied, or waiting for approval. You can show an auditor what the agent did, and what it was stopped from doing.
The tier table
Reading is not refunding. Every action is tiered before it runs.
This is the whole table, published, because a governance claim you cannot inspect is just an adjective. The tier decides what happens next — not the agent, and not how confident it sounds.
| Tier | What it covers | Example | Who may run it |
|---|---|---|---|
| T0 | Read | Search, read, summarise | Any agent with a resolved policy |
| T1 | Draft | Draft, prepare, propose | Any agent with a resolved policy |
| T2 | Reversible change | Update a record, schedule, tag, assign | Agents, up to their ceiling |
| T3 | External or hard to reverse | Send to a customer, publish, spend | Agent prepares · a named person approves |
| T4 | Irreversible or regulated | Pay, delete, deploy, submit a filing | Person only, agent assists |
| T5 | Change the rules | Edit policy, raise a ceiling, add a capability | Designated owners only |
Systems
The operating system is why it is safe. A system is why it is useful on day one.
Each one is a complete operating model for a job — agents, workflows, interfaces, connectors and the approval rules that fit that industry. Every tile carries its real status.
Commerce
PreviewAnswer every customer in seconds, in your words — and hand the hard ones to a person.
Commerce in detailKivara
Design partnerA governed front door for insurance, Medicare and virtual care, in front of the CRM you already run.
Kivara in detailLeadnix
PreviewBrief to campaign, with every claim checked before anything ships.
Leadnix in detailForge
PreviewAgents that build software under proof gates. We run our own company on it.
Forge in detail
You already run Salesforce, HubSpot or an industry CRM. Keep it. A system sits in front of the record you already hold and writes back to it: the conversation, the consent, the approvals and the proof. Our own regulated design treats the customer’s CRM as the agent’s workbench, precisely so nobody has to rip anything out to start.
And the badges are literal. Live means running today. Preview means built and running, for one client or part of the surface, and being packaged. Design partner means specified and reviewed, and built with the first customer. All systems and blueprints.
Proof
One client deployment and our own company. That is the whole list.
This is the point where most sites show you a wall of logos. We have not earned one yet and we are not going to borrow one, so here are three things you can check instead.
214 changes to this product were written by its own agents
Promoted into our codebase between late June and mid-September 2026, across three model vendors, under the same tiers and gates you would run. We are the heaviest user of the thing we are selling you.
How that worksA second model family keeps finding what green tests miss
In our own recorded review rounds it has repeatedly caught real defects after every automated test had already passed. We have not yet run the controlled measurement that would let us put a number on it, so we publish the method and no percentage.
Read the methodWe publish what is not ready
Every capability on this site is labelled live, preview or design partner. The security pack lists the controls that are partial. We would rather lose a deal than win one on a claim you can falsify.
The security pack
How this actually goes
One workflow. Real limits. A measured answer. Then the next one.
You do not buy a platform and go figure it out. You pick the single workflow that costs you the most, and we put it inside governed limits and measure it against your own traffic before it speaks to a customer.
- 01
Pick one workflow
The one that leaks money or time. Chosen on day zero, in writing, with the actions listed.
- 02
Put it inside limits
Each action gets a risk tier. Reversible work runs. Irreversible work waits for a named person.
- 03
Measure before it speaks
It runs in shadow against your real traffic. You see a scorecard, then decide go or no-go.
- 04
Then expand
The next workflow reuses the same policy, memory and audit trail. Nothing is rebuilt.
Every stage ends in something you can act on: a number, a workflow running under its own approval rules, a scorecard that says go or no-go.
Straight answers
What it costs, how long it takes, and what happens when it is wrong.
Agents don’t go rogue here. They go to work.
Start with five questions. They tell us the workflow, the volume and the shape of the budget, and they tell you inside one business hour whether this is worth a call — including if the honest answer is that we are the wrong shop for it.
Five multiple-choice questions. A person replies within one business hour.
Not ready to talk? The security pack states what is live and what is not before you ask us.
Autonomy where it is safe. A human where it is not.