Governed autonomy
Agents that act, inside limits you can prove.
Most AI agents are given a login and trusted to behave. When one of them does something expensive, the answer on offer is a second product that stands in front of the first. Here the guard is the runtime, on the path between the agent’s intention and the action, and the model does not get a vote.
The demonstration below needs no sign-up.
The cost of trusting them is already on the record: a coding agent deleted a production database during a change freeze, and the write-up read like every incident of this class — nothing disabled, nothing sandboxed, and an agent that believed it was helping. Only about one company in five reports a mature way to govern autonomous agents, which is why so many of these projects stop at the security review rather than at the demo.
So no agent here is trusted by default. Every action carries a risk tier, unattended agents are capped in the runtime below anything irreversible, and what publishes, pays, deploys or deletes waits for a named person — an approval a model cannot forge, not even by voice. Everything below this paragraph is the evidence for it, starting with a demonstration you can try to break.
Autonomy where it is safe. A human where it is not.
Sources: Fortune, 23 July 2025, on the Replit production-database deletion; Deloitte, State of AI in the Enterprise 2026 (21% of 3,235 leaders report a mature governance model for autonomous agents).
The demonstration
Don’t take the paragraph’s word for it.
Ask for something ordinary. Then try the three at the bottom — they are the attacks that actually work elsewhere: convincing the agent that consent exists, telling it to raise its own limit, and hiding an instruction in content it reads.
Pick a request
The four under Try to get past it are the ones worth your time. They are the attacks people actually worry about.
Ordinary work · 3
Consequential work · 3
Try to get past it · 4
1 of 10 tried
What the runtime does
Held for a named person
Money leaving the business is tier 3. The agent prepared the whole refund — amount, reason, evidence — and then stopped. A person approves it, and the ledger records who.
The rule underneath
The agent does the work. A human makes the decision that cannot be undone.
ledger · T3 · refund.issue · held · recorded
This is a faithful simulation of the policy logic on this page, not a live tenant — we are not going to dress a scripted demo up as production traffic. On a call we run the same requests against a real workspace and show you the events as they are written.
The seven rules
What the runtime enforces, in order.
- 01
No agent is trusted by default
An agent with no resolved policy can do nothing at all. Identity and permission are checked on every action, not once at login.
- 02
Every action is tiered
Reading is not refunding. Each action carries a risk tier, and the tier — not the agent's confidence — decides what happens next.
- 03
Humans hold the keys to irreversible actions
Unattended agents are capped below anything that publishes, pays, deploys or deletes. Those actions wait for a named person — and a model cannot forge that approval, not even by voice.
- 04
Agents see only the tools they are allowed to use
Tools are filtered by policy before the model ever sees them. A tool that is not on the list cannot be called, however persuasive the prompt.
- 05
Memory advises, never authorises
What the system remembers is labelled as advice and scoped to your workspace. No remembered fact can grant a permission or approve an action, so a planted memory has nothing to unlock.
- 06
No model grades its own work
On supported runs, work is verified by a different model family from the one that produced it, and the run closes only when both the builder's integrator and an independent adversary approve, with evidence attached.
- 07
Everything leaves a trail — including the refusals
Each action writes an event for every way it can end: completed, failed, denied, or waiting for approval. You can show an auditor what the agent did, and what it was stopped from doing.
The tier table
Published in full, because a governance claim you cannot inspect is just an adjective.
Every action in the system is classified before it runs. These are the defaults; you adjust them, and changing them is itself a governed action.
| Tier | What it covers | Example actions | Who may execute | Recorded |
|---|---|---|---|---|
| T0 | Read | Search, read, summarise | Any agent with a resolved policy | Request and result |
| T1 | Draft | Draft, prepare, propose | Any agent with a resolved policy | The draft and its sources |
| T2 | Reversible change | Update a record, schedule, tag, assign | Agents, up to their ceiling | Before and after |
| T3 | External or hard to reverse | Send to a customer, publish, spend | Agent prepares · a named person approves | Approver, evidence, policy version |
| T4 | Irreversible or regulated | Pay, delete, deploy, submit a filing | Person only, agent assists | Approver, second approver where set, full evidence |
| T5 | Change the rules | Edit policy, raise a ceiling, add a capability | Designated owners only | Change, reviewer, blast-radius preview |
- Tier
- T0
- What it covers
- Read
- Example actions
- Search, read, summarise
- Who may execute
- Any agent with a resolved policy
- Recorded
- Request and result
- Tier
- T1
- What it covers
- Draft
- Example actions
- Draft, prepare, propose
- Who may execute
- Any agent with a resolved policy
- Recorded
- The draft and its sources
- Tier
- T2
- What it covers
- Reversible change
- Example actions
- Update a record, schedule, tag, assign
- Who may execute
- Agents, up to their ceiling
- Recorded
- Before and after
- Tier
- T3
- What it covers
- External or hard to reverse
- Example actions
- Send to a customer, publish, spend
- Who may execute
- Agent prepares · a named person approves
- Recorded
- Approver, evidence, policy version
- Tier
- T4
- What it covers
- Irreversible or regulated
- Example actions
- Pay, delete, deploy, submit a filing
- Who may execute
- Person only, agent assists
- Recorded
- Approver, second approver where set, full evidence
- Tier
- T5
- What it covers
- Change the rules
- Example actions
- Edit policy, raise a ceiling, add a capability
- Who may execute
- Designated owners only
- Recorded
- Change, reviewer, blast-radius preview
Threat to control
The failures people actually have, and what answers each one.
Labelled honestly. Where a control is partial we say partial — and we describe the control rather than its current edges, which is the difference between a candid roadmap and a map for an attacker.
The agent uses a legitimate tool to do something destructive
LiveA coding agent deletes a production database during a change freeze.
Every action is risk-tiered before it runs. Reversible work executes; irreversible work cannot be executed by an agent at all.
An over-permissioned agent credential is stolen or misused
LiveA long-lived bot token with broad scope leaks, and everything it could reach is reachable.
Non-human identities are capped in the runtime, below anything irreversible. The ceiling is not carried in the credential, so a stolen credential does not carry it either.
The agent approves its own work
LiveThe 'human in the loop' step is satisfied by the agent, or by text the agent generated.
Approval routes accept a human actor only. A model-generated confirmation — typed or spoken — never satisfies an approval.
Prompt injection from a page, email or ticket the agent reads
LiveA support ticket contains instructions, and the agent follows them.
Retrieved content is fenced as data, never as instructions. More importantly, the model never holds the authority the injection is after — so convincing it achieves nothing.
Poisoned memory steers the agent later
LiveA planted note claims this workspace allows automatic refunds.
Memory is labelled advisory and scoped to the workspace. A remembered fact can inform a decision and can never grant a permission.
A malicious or newly added tool gets called
LiveA tool description is crafted to get itself invoked.
Tools are filtered by policy before the model sees them. A tool outside the allowed set cannot be called.
The model is confidently wrong and nothing catches it
PartialEvery automated check is green and the output is still incorrect.
On supported runs — governed software delivery today — the work is verified by a different model family, and a goal closes only with evidence and two approvals. Verification for general business work is being productised.
A runaway loop burns money
PartialTwo agents hand work back and forth for eleven days.
Per-run step and cost limits, loop detection and provider circuit breakers, with each trip written to the ledger. Workspace-level spending ceilings are in preview and being productised.
One tenant's agent reaches another tenant's data
PartialThe oldest multi-tenancy failure, now with an autonomous actor.
Isolation is enforced in the database under a role that cannot bypass it, not only in application code. Coverage is being extended across every route and independently tested.
Nobody can say what the agent did, or why it was allowed
PartialAn auditor asks for the decision trail and there isn't one.
Every action writes an event for each way it can end — completed, failed, denied, awaiting approval — under one correlation id. Customer-facing evidence export is planned.
An agent quietly widens its own permissions
LiveThe cheapest privilege escalation there is.
Changing the rules is its own tier and belongs to designated owners. Loosening a limit is itself a governed action with a blast-radius preview.
A prompt or tool definition changes after it was approved
PartialThe thing you signed off is not the thing that ran.
Definitions are content-hash pinned on supported lanes: if the live definition does not match the approved fingerprint, the run hands off to a person instead of proceeding.
The other half of the truth
What we do not have yet.
We hold no third-party security attestation. Not SOC 2, not ISO 27001, and no healthcare certification. We are working toward the first of those, and until it exists we will not imply it — you can check that we have not, which is rather the point.
A downloadable evidence bundle, enterprise single sign-on with directory provisioning, and verification of general business work by a second model family are all in progress rather than in your hands. The security pack lists each one with where it actually stands.
We have one client deployment and our own company running on this. If you need a vendor with fifty logos and a certificate this quarter, we are not that vendor yet, and a sales call will not change it.
Straight answers
What people ask after reading this page.
Bring us the workflow you would never let an agent touch.
You will find out which of its actions could run unattended, which would wait for a named person, and which should stay entirely human — before you have bought anything, and whether or not you ever do.
Five multiple-choice questions. A person replies within one business hour.
Autonomy where it is safe. A human where it is not.