You never trust the AI. You bound it.

Bound the agent. Don’t trust it.

An agent is a tool inside a deterministic pipeline — read, reason, write, branch, call a tool. The pipeline is scripted and checkable; the LLM is used for judgment, never for control flow. What an agent may do is set by an autonomy ceiling it has to earn, enforced at the engine, not asked for in a prompt.

Every action lands in an append-only, replayable audit trail. And a case runs on the exact versions of its process, agents, and policies that existed the moment it started — so any decision can be reconstructed as it was actually made, not as the system looks today.

One control stops everything.

A workspace-wide emergency brake. One action pauses every agent, every queue, and every outbound message across the platform. When an incident, a regulator, or a bad change demands it, you don’t hunt for a dozen switches — you pull one, and the whole operation holds until you release it.

Every pull and release lands in the same append-only audit log as everything else — who, when, and why — beside the per-case circuit-breaker trips that catch a runaway agent before it needs workspace-wide action.

Watch it pulled live — a real captured run →

The cheapest model that still passes — and a gate that proves it.

Agents are graded against eval suites before they ship. A multi-model matrix compares quality, latency, and cost per model and recommends the cheapest one that still passes, so you’re not paying frontier prices for a task a smaller model handles.

A drift gate re-runs those suites against a baseline and blocks a deploy on regression — a bad change doesn’t reach production because the numbers moved the wrong way. Judges are calibrated blind so the grader isn’t marking its own work.

See a live eval run with a blind-calibrated judge →

On your network, on your keys — and boring on purpose.

The data plane deploys on-premises or in your private cloud, on your Postgres, inside your network, using your own LLM provider keys. Your data doesn’t detour through us, and your AI spend is your bill at your negotiated rates.

The un-glamorous half of enterprise software is done before you ask: a signed, verifiable offline installer kit; documented and drilled backup and restore; a secret-rotation runbook; a default alerting baseline out of the box; and a TLS / multi-machine network topology guide.

Governed, aligned, and questionnaire-ready.

SSO / SAML for identity, opt-in one-way PHI masking applied at the point of storage, careful secret handling, and a route-level authorization model where every action checks the actor’s role — the same checks the UI enforces, never a new path. Practices are SOC 2-aligned and HIPAA-aligned.

The full enterprise write-up — data handling, tenancy, egress guards, shared-responsibility, and an honest, line-by-line compliance status — lives in the security overview.

Read the full Security & Trust Overview →

Meet systems where they are.

Modern systems get MCP and REST. Thirty-year-old systems get SFTP and a mailbox. Both are first-class. Named, credentialed connections without code: generic REST APIs (OAuth2, API-key, bearer, or basic), SFTP and flat files (CSV and fixed-width — the format legacy systems actually speak), and monitored mailboxes, where a process starts the moment an email arrives.