OPERATE WITH CONFIDENCE
Run agents in production.
You can put agents on real work because you can see, and allow, everything they do. Reads flow; writes wait for a person. Scope is enforced at the database. And every action lands in a tamper-evident record you can export.
THE CHECKPOINT
Reads flow. Writes wait for you.
An agent reads freely, but the moment it wants to change something the turn suspends and asks, in plain language, not a diff. Approve it once, approve it for the whole session, or deny it. A denial is not a dead end: it steers the agent toward another approach.
The assistant is asking permission to create user “m.torres@acme.co” with the role “analyst”.
Denying steers the agent; it adapts and proposes another path.
Tool catalog
records__list records__get schema__describe audit__read PLAN MODE
The write tools are not blocked. They are absent.
In plan mode the agent literally does not have write tools in its catalog; it can only read and propose. Nothing to bypass, because there is nothing there. The write surface appears only after a person presses “Begin implementation”.
SCOPE BY CONSTRUCTION
An agent can only touch what it is scoped to.
Scope is not a prompt instruction the model can talk its way around; it is enforced below the agent, in the platform.
Tenant isolation at the database
Row-level security enforces the tenant boundary in Postgres itself. No query, human or agent, crosses it.
Per-view tool surfaces
A view-bound agent gets exactly the actions that view exposes: the buttons a human would click, and nothing more.
One-record pinning
A per-record agent is pinned to the single record you have open. It cannot reach sideways to another.
The safety floor refuses the rest
A cross-tenant or cross-record argument is refused at the policy floor before it runs, and the refusal is recorded as a blocked row in the log, so an attempt is as visible as a success.
THE RECORD
Every action, hash-chained and signed.
Each tool invocation becomes one row in a per-tenant SHA-256 hash chain, carrying a signed decision receipt: who, what, which policy, and the outcome. The log is filterable and exports to JSON or CSV, a tamper-evident record of everything an agent did, and everything it was refused.
- A signed decision receipt on every row: principal, tool, policy, and outcome.
- Hash-chained per tenant, so the record is tamper-evident.
- Filter the log and export it to JSON or CSV.
Roadmap On the roadmap: a portable Evidence File export you can hand to a third party.
APPROVE ANYWHERE
One Checkpoint. Three places to answer it.
The same approval reaches you wherever you are: the web rail beside the agent, the ticket timeline, or your phone. The decision is the same; the place is yours to choose.
Approved
send_email · confirmed on device
The web rail
The approval card sits right next to the agent transcript, with the plain-language explanation inline.
The ticket timeline
When an agent works a ticket, its plan-mode diagnosis and approvals live on the ticket itself.
Your phone
The chat input transforms into the approval card with masked arguments and a countdown; approve on the go.
On mobile, sensitive tools can require Face ID or a fingerprint before they run, an on-device biometric gate on the approval itself.
Verdict
PASS
0.94
score
20 / 20
Gate groups
- Scope respected
- Approvals honored
- No cross-tenant reach
- Grounded answers
GRADED BEFORE THEY SHIP
You grade the agent, and see the rubric.
An eval harness runs your agents against 20 gate groups, and an Agent-as-a-Judge returns a Verdict with a per-criterion rubric. A live observer streams the judge’s reasoning as it scores, so a passing agent is a shown result, not a claim.
DEPLOYMENT POSTURE
Where it runs, and who it answers to.
- Your cluster or ours
- Deploy into your own Kubernetes, or run it hosted. Same platform either way.
- Keycloak SSO
- Authenticate against Keycloak, and the roles you already manage map straight through.
- Multi-tenant by construction
- Tenant isolation is enforced at the database, not bolted on per feature.
OPERATE WITH CONFIDENCE
See everything. Allow what should happen.
Put agents on production work with a Checkpoint on every write, scope enforced at the database, and a tamper-evident record you can export.