OPERATE WITH CONFIDENCE
Run agents in production.
You can put agents on real work because you can see — and allow — everything they do. Reads flow; writes wait for a person. Scope is enforced at the database. And every action lands in a tamper-evident record you can export.
THE CHECKPOINT
Reads flow. Writes wait for you.
An agent reads freely, but the moment it wants to change something the turn suspends and asks — in plain language, not a diff. Approve it once, approve it for the whole session, or deny it. A denial is not a dead end: it steers the agent toward another approach.
The assistant is asking permission to create user: “m.torres@acme.co” with the role “analyst”.
Denying steers the agent — it adapts and proposes another path.
Tool catalog
records__list records__get schema__describe audit__read PLAN MODE
The write tools are not blocked. They are absent.
In plan mode the agent literally does not have write tools in its catalog — it can only read and propose. Nothing to bypass, because there is nothing there. The write surface appears only after a person presses “Begin implementation”.
SCOPE BY CONSTRUCTION
An agent can only touch what it is scoped to.
Scope is not a prompt instruction the model can talk its way around — it is enforced below the agent, in the platform.
Tenant isolation at the database
Row-level security enforces the tenant boundary in Postgres itself. No query, human or agent, crosses it.
Per-view tool surfaces
A view-bound agent gets exactly the actions that view exposes — the buttons a human would click, and nothing more.
One-record pinning
A per-record agent is pinned to the single record you have open. It cannot reach sideways to another.
The safety floor refuses the rest
A cross-tenant or cross-record argument is refused at the policy floor before it runs — and the refusal is recorded as a blocked row in the log, so an attempt is as visible as a success.
THE RECORD
Every action, hash-chained and signed.
Each tool invocation becomes one row in a per-tenant SHA-256 hash chain, carrying a signed decision receipt: who, what, which policy, and the outcome. The log is filterable and exports to JSON or CSV — a tamper-evident record of everything an agent did, and everything it was refused.
- A signed decision receipt on every row: principal, tool, policy, and outcome.
- Hash-chained per tenant — the record is tamper-evident.
- Filter the log and export it to JSON or CSV.
Roadmap On the roadmap: a portable Evidence File export you can hand to a third party.
APPROVE ANYWHERE
One Checkpoint. Three places to answer it.
The same approval reaches you wherever you are — the web rail beside the agent, the ticket timeline, or your phone. The decision is the same; the place is yours to choose.
Approved
send_email · confirmed on device
The web rail
The approval card sits right next to the agent transcript, with the plain-language explanation inline.
The ticket timeline
When an agent works a ticket, its plan-mode diagnosis and approvals live on the ticket itself.
Your phone
The chat input transforms into the approval card with masked arguments and a countdown — approve on the go.
On mobile, sensitive tools can require Face ID or a fingerprint before they run — an on-device biometric gate on the approval itself.
Verdict
PASS
0.94
score
20 / 20
Gate groups
- Scope respected
- Approvals honored
- No cross-tenant reach
- Grounded answers
GRADED BEFORE THEY SHIP
You grade the agent — and see the rubric.
An eval harness runs your agents against 20 gate groups, and an Agent-as-a-Judge returns a Verdict with a per-criterion rubric. A live observer streams the judge’s reasoning as it scores, so a passing agent is a shown result, not a claim.
DEPLOYMENT POSTURE
Where it runs, and who it answers to.
- Your cluster or ours
- Deploy into your own Kubernetes, or run it hosted. Same platform either way.
- Keycloak SSO
- Authenticate against Keycloak — the roles you already manage map straight through.
- Multi-tenant by construction
- Tenant isolation is enforced at the database, not bolted on per feature.
OPERATE WITH CONFIDENCE
See everything. Allow what should happen.
Put agents on production work with a Checkpoint on every write, scope enforced at the database, and a tamper-evident record you can export.