Compare
Compare the architecture, not the adjectives.
Every platform in this category says governance is built in. Underneath the word there are only three shapes, and they fail in different places. This page is about the shapes — including the places where ours is the wrong one and you should buy something else.
We concede first. It is section one for a reason.
First, the concession
What the vertical suites have that we do not.
The serious products in this market are not thin. The clearest example is Kizen, whose public materials and developer documentation we read in full on 19 September 2026: a configurable CRM and work-management platform with years of production behind it, carrier contracting rules encoded, multi-level commission structures with effective dating, agent and agency portals, document indexing delivered with a partner, and developer documentation that is more candid than most of its peers. In insurance distribution that depth is real and it took a long time to build. We do not have it.
Their site also presents the security and compliance materials a procurement team asks for first, behind a trust centre. We have not independently verified the scope or current status of any of it, and you should ask them for it directly rather than take our word. We hold no attestation at all. Independent attestation is in progress and that is the whole of what we are willing to say about it, because a badge a buyer cannot verify is the one mistake that cannot be walked back.
So if the problem you are solving this quarter is commissions, contracting and carrier hierarchy, or if your procurement gate is a finished audit report, the honest answer is that you should be talking to them and not to us. We say that on calls too, and we have said it to people who were ready to sign.
What follows is not an attack on any of that. It is a comparison of architectures, because the architecture is the part that decides what an agent is able to do at two in the morning when nobody is reading the dashboard.
Three architectures
Three ways to make an agent safe.
They are not interchangeable, and none of them is stupid. Each is a reasonable answer to a different question, and the mistake buyers make is assuming the word “governance” means the same thing in all three.
- The vertical suites and the automation platforms
A workflow with LLM steps
A deterministic, queue-based automation engine in which one of the available step types calls a model. The orchestration is the engine that was already there; the agent is a step inside it.
What it is good at
Repeatability. The path is drawn in advance, so it runs the same way twice, it audits as a sequence, and years of operational hardening sit underneath it. For a process that genuinely is a fixed sequence — intake, routing, a document, a notification — this is the right shape, and an agent runtime is over-engineering.
Where it strains
In this shape the model step typically runs with whatever access the workflow was given, rather than the access of the person who triggered it. Changing the logic and changing the runs already in flight are often the same operation. And a workflow that finishes reports that it finished, which is a different statement from reporting that it worked.
- The agent-security category
A bolt-on guard in front of someone else’s agent
A separate product that sits between agents you did not build and the systems they reach, inspecting traffic and applying policy from the outside.
What it is good at
Coverage you cannot get any other way. If your organisation already has agents from four vendors and a shadow copy of a fifth, an external guard is the only thing that sees all of them at once. For a security team that needs an answer this quarter about agents it does not control, this is a real answer and we would not argue with it.
Where it strains
A guard sees the request, not the intent behind it, and it cannot make an irreversible action reversible after the fact. You end up with two vendors and two policy languages describing one rule, and the guard’s authority stops where the agent’s own credentials begin. It is also the only shape here where you are buying a second product whose job is to watch the first.
- What we build
A governed agent runtime
One runtime in which the agent’s identity, its policy, the risk tier of each action, the approval, the verification and the audit record are the same system. Nothing is bolted on, because there is no outside to bolt it to.
What it is good at
The questions that can only be answered from inside. Every action is classified before it runs, and the tier decides what happens next rather than the agent’s confidence. Tools are filtered by policy before the model is shown them, so a tool that is not allowed cannot be argued into existence. And work does not close on the agent’s own say-so.
Where it strains
We are the youngest of the three, and the list is not short: no attestations held, no public sign-up or billing yet, a thin CRM, no document-AI product, and a connector set weighted towards models, messaging and media rather than the enterprise suites. If your evaluation is a feature matrix against an established platform, we lose it on rows, and we know which ones.
There is a fourth shape, and it is the most common one of all: an agent with a login and a log. It is not on this list because nobody sells it deliberately. It is what you end up with by default, and it is what this whole site is arguing against.
Primary sources
We quote rather than summarise.
A paraphrase of a limit is nearly always stronger than the limit. So here are the sentences themselves, from one vendor’s own developer documentation and release notes, read on 19 September 2026. Nothing is trimmed to make a point, and the links are there so you can check whether they still say this.
“Kizen Automations are now Agentic Workflows… The execution engine is the same.”
developer.kizen.com/release/2026 · read 19 September 2026
What it tells you. A rename that the vendor tells you is a rename. It is a design decision rather than a defect, and it is precisely the difference between the first architecture below and the third.
“Permissions do not apply at runtime — Agentic Workflows run with elevated access, bypassing the permissions of the user who configured or triggered them.”
developer.kizen.com/docs/concepts/agentic-workflows/agentic-workflow-core-concepts · read 19 September 2026
What it tells you. This is question one, answered in the vendor’s own words before anyone had to ask. Most products in this category do not write the answer down anywhere.
“There is no versioning. Saving a change takes effect immediately, including for in-progress executions.”
developer.kizen.com/docs/concepts/agentic-workflows/agentic-workflow-core-concepts · read 19 September 2026
What it tells you. This is question two. Note what the sentence actually says and what it does not: it is about workflow definitions, and we are not going to stretch it further than that.
“Completed ≠ successful — A Completed status means execution finished, not that every step produced the intended result.”
developer.kizen.com/docs/concepts/agentic-workflows/agentic-workflow-core-concepts · read 19 September 2026
What it tells you. Question three, and the most useful sentence we read anywhere in this category. It is true of nearly every orchestration product. This one says so out loud.
“Kizen does not provide public sandbox environments, so integrations operate directly against production environments.”
developer.kizen.com/docs/developers/environments · read 19 September 2026
What it tells you. Part of question five. For the avoidance of any doubt: we do not have a public sandbox either, and ours is on the build plan rather than in your hands.
Credit where it is due. Documentation that says “Completed ≠ successful” out loud is doing its readers a service. Most products in this category never write that sentence anywhere, and their status field does not mean any more for the silence. If you take one habit away from this page, take that one: read the developer documentation, not the home page. It is where vendors are forced to be precise, and it is free.
Take these with you
Five questions to ask any agent vendor.
Neutral on purpose. Put them to everyone on your shortlist, in these words, and put them to us. Of the five, we answer three well, one partly, and one we currently lose. We have written our own answers underneath so you can hold us to them.
- 01
“When one of your agents runs, whose permissions does it run with?”
Why it matters. This is the entire security model in one sentence. An agent running with the elevated access of the automation that launched it is a different risk from an agent running under a policy resolved for itself. The answer decides how much of the rest matters.
We answer this one well.
Its own. Every action an agent attempts is classified by risk tier before it runs, and the tier decides what happens next rather than the agent’s confidence in itself. The full model, action by action, is on the governed autonomy page.
- 02
“If I change an agent’s instructions, does the change reach runs already in flight — and can I roll it back?”
Why it matters. Two failures hide in this question. One is a change that mutates work already running, which is how a small edit becomes an incident nobody can reconstruct. The other is having no way back.
We answer this one partly.
Agent definitions are versioned and pinned to the version a run started with, and a promotion is reversible because it is pinned to the change that passed its gates. The honest limit: that is true on our own lanes today, and a customer-facing surface for drafting, publishing and rolling back agent definitions is in preview rather than in your hands.
- 03
“Your status says completed. Does that mean it worked?”
Why it matters. In most systems “completed” means the process reached the end, not that the result was correct. Those are different claims, and the gap between them is where agent work quietly goes wrong at scale.
We answer this one well for engineering, partly elsewhere.
On governed software delivery, a run does not close without evidence and two approvals, one of them from a reviewer that did not do the work. For general business work — a reply, a document, a record change — that same control is being productised, and we are not going to describe it as finished.
- 04
“Who checks the agent’s output — another copy of the same model, or something independent?”
Why it matters. A model asked to grade its own work tends to reproduce the reasoning that produced it. A confidence score is the model’s opinion of itself, and a human review task only helps if a human actually has the time.
We answer this one well, with the scope stated.
A different model family reviews, and its brief is to refute rather than to bless. That is live for governed software delivery: across our own recorded review rounds, more than half surfaced a real defect after every automated test had already passed. We publish no percentage improvement, because the controlled benchmark that would earn one has not been run.
- 05
“How fast do I get a real number, and what can I try without talking to anyone?”
Why it matters. Every vendor in this category answers the price question with a call. The thing worth measuring is not whether the number is on a page — it is how long it takes to get one that survives contact with your team, and whether you can evaluate anything at all before that call happens.
No price list, a fast number, and an evaluation you can start alone.
We do not publish a price list either, and we will not pretend that is a virtue in itself: scopes differ enough that a table would be wrong in both directions. What we do instead is publish the budget bands and what each one typically buys, ask five questions, and come back within the business hour with a scope and a figure. And the evaluation does not wait on us: the demonstration on this site needs no sign-up, and the security pack states what is live and what is not before you ask. There is no self-serve sign-up or billing yet, so if buying with a card this afternoon is the requirement, we are a waitlist rather than a purchase.
A sixth, if you want one: ask to be shown a refusal. Not a demo of the agent working — a demo of it being stopped, and the record it leaves behind when it is.
Disqualification
When you should not choose us.
This section exists because it is true, and because a comparison page without one is an advertisement. If you are in any of these situations, the fastest thing we can do for you is say so now.
Your gate this quarter is a completed audit report
We do not hold SOC 2 or ISO 27001. Independent attestation is in progress, and that is the strongest sentence we are willing to write about it. If procurement will not open a file without the report in hand, start with a vendor who has one, and ask them question one anyway.
You need insurance commissions, contracting and carrier hierarchy now
Multi-level commission structures with effective dating, carrier contracting rules, four-level agent and agency portals and the enrolment integrations that market runs on are years of encoded operational detail. We do not have them and will not have them this quarter. The honest play is to leave that back office where it is; we would sell you the governed conversation layer in front of it, or nothing.
You want to sign up with a card and start this afternoon
There is no public sign-up and no billing. Our work today is delivered: scoped with you, then quoted. If buying with a card is the requirement, we are a waitlist, not a purchase.
You need a mature, configurable CRM as your system of record
Keep the one you have. Our design treats your CRM as the agent’s workbench rather than something to replace, precisely because replacing it is a two-year project nobody asked for.
You need document AI at volume
Classification, extraction and indexing of documents at scale is a product in its own right, and it is not one of ours. If that is the centre of the problem, buy it from someone whose centre it is.
You need enterprise single sign-on and provisioning on day one
Per-tenant SAML and SCIM are designed, not built. Today sign-in is simpler than an enterprise identity team will accept, and we would rather say so than discover it in week three of your security review.
You only want a chatbot
Then buy a chatbot. Several are good and they cost about what a phone line costs. Governance is the expensive part of what we do, and you should not pay for it if nothing you are automating can hurt you.
And when we are the right answer.
- Your security person’s first question is “what stops it?” That question is answered inside the runtime or it is not answered. We publish the tier table so the answer can be inspected before you buy.
- You need one governed backend behind several branded front doors. An agency, a franchise group, a practice with several sites: separate workspaces, separate data, one set of rules that the people using it cannot switch off.
- You want the model choice to stay yours. Several model families behind one policy with failover, chosen per workspace. The agents you already have can join through MCP rather than being rebuilt.
Straight answers
About this page in particular.
We will send you the long version.
The full architecture comparison — every quote, every source URL, the date we read it, and an explicit list of the places where we looked and found no answer either way — goes out as a document on request. No form gate, no drip sequence, and it includes the rows where we come off worse.
Five multiple-choice questions. A person replies within one business hour.
Competitor quotations are verbatim from that vendor’s own published documentation, with the source and the date read. They are re-checked before each release of this page. Corrections: tell us.