Your agent is one convincing sentence away from something you cannot undo.

Every action carries a risk tier, and the tier decides what happens next — not the agent’s confidence, and not how the request was phrased. This is enforced on the governed action path your workflows run on; the security pack states the coverage across the rest of the surface.

Unattended agents have a ceiling that is not a setting. An agent running without a person present cannot reach the tiers that publish, pay, deploy or delete, whatever it is told and however it is told.

Irreversible actions wait for a named person, and an agent cannot approve itself. Approvals are recorded with the approver, the evidence and the policy version that applied at the time.

The approval inbox your own staff will use — mobile, email and chat, with delegation and a two-person rule for the top tier — is in preview. Approvals run in the operator console today, which works and is not yet the experience a claims supervisor deserves.

Agents see only the tools their policy allows. The list is filtered before the model receives it, so prompt injection has nothing to reach for: an unoffered tool is not a tool the model can be talked into using.

Every agent has its own scoped, audited identity, so the trail says which agent acted rather than which service account was borrowed. Per-agent identities for customer workspaces, with rotation, are being packaged.

You set the spending ceiling per workspace, per agent and per run. Per-run step and cost caps, loop detection and provider breakers are in place today; workspace-wide budget control is handled with you during delivery and is being productised, and at a ceiling the default is stop, not bill.

Your data is fenced by the database, not by application code remembering to filter. Coverage across the whole surface, and the cross-tenant negative-test report that evidences it, are covered in the security pack on request.

Change the rules yourself, with a preview of the blast radius — what a policy change would affect, before you commit it. The customer-grade editor is in preview; today we configure policy with you and hand over the run-book.

Everything leaves a trail, including the refusals. Each action writes an event for every way it can end — completed, failed, denied, or waiting on a person — under one correlation id.

Download the evidence for a run: who asked, which agent and policy version, which tools were offered and which were used, the approvals, the checks and the votes. The export surface is specified and not yet built, so today we produce that bundle with you.

Workspaces assemble around the job. An approval queue, a console, a form and a conversation are different shapes of the same governed work, and the person doing the job should get the shape that fits it.

Your brand, your domain, our governed backend. The front end belongs to you and looks like you; authority never leaves the backend, so a client-facing app cannot grant itself powers the policy did not give it. Running for one deployment today, which is why this line is marked preview and not live.

Install a system or a module rather than commissioning one. Modules are registered objects that reconcile on boot; the self-serve gallery that browses them is being packaged.

Any model, behind one gateway, with failover. The major commercial families and open-weight models are reached the same way, so the model becomes configuration. You choose which families are allowed, which matters when a regulator or a procurement policy rules one out.

Choose per workspace; bring your own keys. Per-workspace model configuration runs today and the customer-facing key surface is in preview, so during a build we wire your contracted access with you.

Model diversity is a safety property here, not a procurement one. It is what makes an independent checker possible on supported runs: the verifier is never drawn from the same family as the builder.

Open by standard. Any MCP-speaking agent or server shares the same governed context and the same action surface, which is also the fastest route to a tool we have not built an adapter for yet. Published developer docs are on the build plan.

Connect your channels and business tools. About twenty adapters run today and the business-tool set is being extended one at a time. We would rather hand you the adapter list, including what is missing, than a marketplace page of cards with nothing behind them.

Cost is recorded per agent, per workspace and per provider, including the checker’s. The customer-facing dashboard is in preview; today those numbers reach you in the monthly governance report.

Private deployment and self-hosting. The platform is componentised and runs on our own cluster; a packaged customer install path is built with the first customer who requires it.