Give your agents room to think.
Give every action an explicit boundary.
Sign up with Google, Microsoft or email · Free to start · No card needed
Sign up, and your company has a workspace with two assistants, agents and workflows, the AI models you choose, connections to your mail and files, and the governance that decides what any of them may do.
Ask about your company’s runs, approvals, agents and spend — or ask it to do something. It answers from the live platform and acts only within what you may do; anything that changes something is shown to you first. Type, or talk to it and hear it answer.
Foundry composes agents, workflows and configuration through the platform’s own interfaces — as you, with your permissions — on your own Anthropic account, and shows every step it took. When an agent needs code it cannot write itself, Foundry writes and tests it, and a different person approves it before the agent carries on.
Give a goal to an agent that plans and works it through — bringing in another of your agents, live, when it needs a specialist — or define a workflow that runs the same steps every time. The actions that matter wait for the person your policy names.
Connect Claude, Gemini, OpenAI or Groq with your own account, or start with OpenRouter’s free models. Each job — general, fast, reasoning, coding, vision, speech — gets the model you choose, at prices you can see.
Each person can connect their own Outlook and OneDrive — Gmail and Google Drive are open to invited testers until Google’s review is complete — and a company connects its databases and business systems, which the Copilot can question for analysis without writing to them. Documents are read page by page on the platform’s own servers, with no vision model and no cloud OCR seeing a page, and answers say where they came from.
Policies decide what needs a person, separation of duties stops anyone approving their own request, budgets cap what AI may spend, and every action lands in a tamper-evident record.
Creating an account is free. Start on the allowance and the free models, and connect your own AI account when you are ready — its provider bills you directly.
Sign up with Google, Microsoft or your email. Your company’s workspace is ready in a minute, and you are its administrator.
A short guide fills in what it already knows — your name, your company, your industry, where you operate — for you to check. Give it your company’s website or a document, and it drafts your departments, agents, workflows and policies, each citing its source, for you to review — agents and workflows arrive as drafts. Every step can be skipped.
Connect your own Claude, Gemini, OpenAI or Groq account, or switch on OpenRouter’s free models and let the cheapest model that fits take each job.
Ask the Copilot, describe something to Foundry, or start from your industry’s pack — and decide which actions wait for a person before anything acts.
AI agents are good at reading, reasoning and preparing work. The risk is what they do next. A2A Matrix lets them do real work in your systems — and keeps the important steps with your people.
A person or a system gives an agent a job — reconcile this week’s payments, prepare this claim, find out why the service is slow.
It reads what it is allowed to read, works the problem out, and proposes the actions it thinks are needed. Proposing grants it nothing.
Every proposed action is checked against what the person who asked may do. The risky ones — money moving, a customer contacted, production changed — wait for the named approver.
Who asked, what the agent relied on, who approved and what actually happened — kept in a record no one can quietly change.
Put AI to work on real processes without handing it a blank cheque. Start with one workflow and widen it as trust grows.
Human oversight you can demonstrate, and the records auditors and regulators ask for — including under the EU AI Act.
The EU AI Act and AI agentsLeast privilege for every agent, companies isolated in the database, keys in your own vault if you want them there — and it can run in your estate.
Governing MCP toolsWorks with your identity provider, the models you choose, tools over MCP and a connector for calling other agents over the A2A protocol.
The A2A protocol, governedThe decisive moment is when a proposed action meets a boundary. Explore how approval, refusal, and execution differ in these fictional scenarios.
Reconcile this week’s merchant disbursements and stage the payment batch for release.
In this example, policy asks for two authorised approvers and refuses the one who prepared it — separation of duties means a requester cannot satisfy their own quorum.
Most organisations already have capable assistants and almost nothing they are allowed to do. A2A Matrix is built for the gap between the two: the permission, the review, and the record that let an agent act on something that matters.
Assistants can draft, summarise and reason well enough to be useful. What stops them reaching real systems is not capability: it is that nobody can say in advance what one is allowed to touch, or show afterwards what it did.
Every action an agent proposes is checked against what that person is permitted to do, held for a named reviewer when the action deserves one, and written down as it happens. Real systems become reachable because the boundary is explicit.
An approval arrives with what would change and what else depends on it, and it expires rather than sitting forever. Refusing is a normal outcome, recorded like any other — not an error state someone has to explain.
The record is appended in the same transaction as the work it describes, so either both happened or neither did, and the chain is verifiable per tenant. It shows what was decided and by whom; it does not claim the business outcome was correct.
The Rust WebAssembly sandbox gives a module nothing that reaches the host — it cannot open a host file or resolve a hostname, because the only system it sees is one the platform answers from memory. Bounded by fuel (instructions executed), a memory ceiling and a wall clock, so two runs of the same code cost the same and a replay means something. These limits cover modules run through that sandbox.
A caller asks for an exposure mode and policy caps it: redacted before it leaves (the default), sent whole only to a private model, or raw where the tenant's policy permits it. Detector coverage, model-provider retention settings and your own classification still matter; exposure control is a boundary, not a compliance certificate.
Audit events are appended in the same database transaction as the change they record — both commit or neither does — hash-chained per tenant with length-prefixed digests, and periodically anchored with an Ed25519 signature. Integrity helps detect alteration; it does not prove a business result correct.
Caller identity, tenant scope, assigned capabilities and resolved permissions decide access, and tenant separation is enforced by row-level security in the database rather than only in application code. A credential that tries to assert its own permissions is refused, not ignored. Proposing a tool call grants an agent nothing.
A2A Matrix is industry-agnostic. These illustrative applications use the Compute → Ground → Verify pattern. Connectors, domain validation and approval policies are configured per environment — and for ten industries, that configuration already exists.
Reconcile disbursements, assemble a credit packet, triage an alert queue, prepare a settlement. Figures come from the systems that hold them, through connectors, rather than from the model — the agent gathers, states what it relied on, and stops. Releasing funds is a separate authority, and policy can require two approvers who are not the person who prepared it.
The detail for this industryAssemble administrative context, draft referrals and prior-authorisation packets, match trial eligibility criteria. What leaves the estate is bounded by the tenant’s exposure policy, and clinical staff keep sign-off on every patient-facing action. HIPAA obligations belong to your deployment and your agreements; the platform supplies the boundary and the record, not the certificate.
The detail for this industryTake a first notice of loss, read the policy against the facts, line up estimates, and compile the file an adjuster decides from — with the exceptions worth a human look raised rather than buried. The assistant cites the clauses it relied on; approving a claim and authorising a payment stay with the adjuster.
The detail for this industryTriage production anomalies, work through a tier-one alert queue, and stage the remediation a responder would run. The loop is bounded by iteration and time budgets with a recorded stop reason, investigation and authority are different permissions, and changing a running system waits for the operator who owns it.
The detail for this industryRead obligations across jurisdictions, pull risk clauses out of a vendor estate nobody has re-read since signature, and assemble the pack behind a filing. The work is the analysis, not the certification: what the platform adds is that every step is attributable and the evidence sits in a per-tenant hash chain an assessor can verify.
Match purchase orders, receipts and invoices across systems that were never designed to agree, surface the exceptions, and draft the supplier note. Spending thresholds are policy rows rather than code, so raising one is a governed configuration change with a record — not a release.
Thirty-six short chapters, narrated by three voices, from a goal to a plan, agents, approvals, evidence and learning. An architectural walkthrough, not live telemetry.
6 acts · 36 connected chapters
Explore a topic. Hear the decisions behind it.
From a business goal to a grounded plan, a task DAG, or a defined workflow.
Conceptual walkthrough · not live telemetryA goal describes the work to achieve, the responsible agent, and the boundaries it must operate within.
Intent → scoped goal“Let’s follow a purchase review. The goal is to compare supplier quotes and prepare a recommendation.”
Recorded narration — the same voices on every device.
Lead Architect Let’s follow a purchase review. The goal is to compare supplier quotes and prepare a recommendation.
Policy Specialist Does that goal also give the agent permission to place an order?
Runtime Sentry No. The goal describes the outcome. Tool assignments, permissions, and policy still determine which actions are available.
Lead Architect We start with the same goal description. The task planner analyzes the work and proposes the smallest useful set of steps and dependencies.
Policy Specialist Can it invent an agent, assume a tool exists, or execute the proposal immediately?
Runtime Sentry Grounding checks the available agents, tools, and dependency graph. The proposal is reviewed and approved before the separate execute action materializes work.
Lead Architect An approved plan can contain a task DAG. Gathering supplier data and gathering requirements can branch before a comparison task joins their results.
Policy Specialist Is this the agent inventing more tasks during every reasoning iteration?
Runtime Sentry No. This graph is materialized from the approved plan. Each task has its own instruction; the orchestrator checks dependencies before dispatch. Workflow graphs remain a separate execution model.
Runtime Sentry A run gives execution an identity. Direct agentic work carries a task; an approved task plan can materialize several dependency-linked tasks.
Lead Architect How does the operator distinguish the intent from the work actually running?
Runtime Sentry The goal describes the outcome. The run records an execution attempt. Its tasks carry instructions, state, and dependencies that the operator can inspect.
Lead Architect Some work should follow a process you define in advance. That is the workflow plane: steps and dependencies in a graph.
Policy Specialist So does every goal become a workflow?
Runtime Sentry No. An agentic goal and a deterministic workflow are distinct execution models. A workflow follows its defined graph; an agent loop chooses its next intent within its boundaries.
Lead Architect Sometimes one workflow step needs reasoning. The agent task step is the deliberate bridge.
Runtime Sentry That step starts a nested goal, run, and task. The workflow can wait for the nested result instead of turning its entire graph into an agent loop.
Policy Specialist The bridge still needs clear deadlines, cancellation, and an output contract. This describes the platform design; integration coverage must be checked in the deployed environment.
Lead Architect The agent combines available context with a model call, proposes an action, and observes the result.
Policy Specialist Can that reasoning loop continue forever?
Runtime Sentry No. Iteration and time budgets give it stopping conditions. Waiting for a required human approval is different from a runtime failure. The lights here illustrate a loop; they are not live model activity.
Lead Architect An agent can ask another agent to handle a scoped subtask. The delegated run retains its parent and root lineage.
Policy Specialist What prevents delegation from growing into an unlimited tree of agents?
Runtime Sentry Policy, depth, fan-out, shared token budgets, and deadlines bound it. Internal delegation is served by the agent runtime; external A2A discovery, send, status and cancellation reach another platform through a connector.
Lead Architect A War Room brings several agent perspectives into a shared discussion, helping operators examine a problem from more than one angle.
Policy Specialist Does agreement between agents count as permission to act?
Runtime Sentry No. Discussion and synthesis inform the operator. They do not replace permissions, evidence, or required approval. This collaboration surface lives in the console platform.
Lead Architect The model gateway resolves the configured model and provider while tracking usage and the request budget.
Policy Specialist What happens to sensitive data before a provider receives it?
Runtime Sentry The configured exposure decision controls the path, including masking or private-model restrictions where applicable. The protection depends on the selected policy and supported request path.
Lead Architect A useful answer needs relevant context. Knowledge sources, retrieval, memory, and artifacts give that context an organized path.
Policy Specialist Does storing information in memory automatically train a model or make the information trustworthy?
Runtime Sentry No. Retrieval supplies context, not automatic model training. Source quality, access scope, and validation still matter, and retrieval health helps operators inspect the path.
Runtime Sentry After the required checks clear, the tool gateway dispatches to the configured integration and returns its result.
Policy Specialist Does access to one tool mean access to every system?
Lead Architect No. Tools are assigned and scoped. The returned observation helps the agent decide its next step without widening its authority.
Lead Architect Generated computation needs a boundary stronger than a prompt. The WebAssembly sandbox limits instructions, memory growth, and elapsed time.
Policy Specialist Can a module simply open a file or contact the network?
Runtime Sentry The sandbox core links no ambient host capabilities. Output still needs validation. This describes the WASM execution boundary, not a claim that every connector or generated-code path already uses it.
Lead Architect The same platform serves different organizations. Company scope follows a request into resource access, configuration, and recorded evidence.
Policy Specialist Is selecting a company in the interface enough to establish isolation?
Runtime Sentry No. The server checks the caller and tenant scope. Roles, memberships, resource permissions, and scoped database access are parts of that boundary; shared infrastructure is not shared authority.
Lead Architect Human identity comes from the identity provider. Service calls also carry verifiable credentials rather than inheriting trust from their network location.
Policy Specialist Can an agent grant itself more permissions when a task becomes difficult?
Runtime Sentry No. Permission resolution and scoped grants define the available authority. Deactivated memberships, teams, or suspended tenants must be handled by the authorization path.
Policy Specialist A model proposes an intent. Identity, assigned capabilities, and policy decide whether it may proceed.
Lead Architect And if submitting the order requires a human?
Policy Specialist Execution waits for the configured approval decision. Separation of duties can keep the requester from approving their own action. An agent recommendation is not a human approval.
Lead Architect Bring Your Own Key lets a company supply credentials for its model provider. The gateway resolves company-specific credentials before permitted shared fallbacks.
Policy Specialist Does bringing a key bypass model policy or automatically mean there is no fallback?
Runtime Sentry No. Provider access and policy still apply, and fallback depends on configuration. Keys belong in the credential path, not the prompt, the browser, or this illustration.
Lead Architect Bring Your Own Vault separates secret ownership from platform configuration. A company can point supported secret resolution at its verified backend.
Policy Specialist Is that the same as copying the entire vault into the platform?
Runtime Sentry No. Configuration records coordinates and references. Supported consumers read what they need through the resolver. BYOV coverage is consumer-specific, and its management surface is in the console.
Lead Architect Cryptography has several jobs here. AES-256-GCM protects supported encrypted fields; SHA-256 digests help check whether recorded content has changed.
Policy Specialist Is a hash encryption, or proof that an AI answer is correct?
Runtime Sentry Neither. Encryption, signatures, and integrity checks solve different problems. Keys, access controls, verification, and business validation still matter. The visual shows concepts, not real secrets or issued evidence.
Lead Architect The control plane holds the settings that shape execution: limits, policies, models, connectors, and environment-specific configuration.
Policy Specialist Should changing a security setting be an invisible edit inside an agent run?
Runtime Sentry No. Versioned releases and the configured approval process make changes reviewable. Published configuration must be resolved by the actual consumer for the control to take effect.
Lead Architect Work often waits in a queue before a worker can take it. Queue health connects backlog, active workers, retries, and delayed jobs.
Policy Specialist Does a rising queue automatically mean the agent is still making useful progress?
Runtime Sentry No. Readiness, backlog age, failures, and dead letters provide context. Operators need the actual queue and worker signals, not activity inferred from a moving diagram.
Lead Architect Redis Streams give a producer and consumer a durable handoff, with consumer groups and visible pending entries.
Policy Specialist Does an acknowledgement protocol guarantee that a job can never run twice?
Runtime Sentry No. Delivery is at least once, so handlers need idempotency. Reclaim and retry recover abandoned work. The code also contains a separate BullMQ-compatible queue path; the two are not interchangeable.
Lead Architect A failing dependency should not attract unlimited retries. A circuit breaker can temporarily stop calls after its failure threshold is reached.
Policy Specialist How does the system find out whether that dependency has recovered?
Runtime Sentry A controlled half-open probe can test recovery before normal traffic resumes. Deadlines and retry budgets still apply. The mechanism lives in the shared transport, so coverage follows whichever transport a caller uses.
Lead Architect When work stalls, the platform needs more than a red indicator. An incident records the affected resource, severity, and available context.
Policy Specialist Does acknowledging an incident mean the underlying run has been repaired?
Runtime Sentry No. Acknowledgement assigns attention; resolution records the outcome. Timelines, traces, audit events, and queue state help explain what happened before recovery is attempted.
Lead Architect The operator needs to inspect more than the final answer. Recorded events and output artifacts provide supporting evidence.
Policy Specialist Does verifying an audit hash prove the decision was correct?
Runtime Sentry No. Hash verification helps reveal changes to recorded evidence. Business correctness still needs validation. This walkthrough is scripted and has not placed an order or executed a live run.
Lead Architect A completed run can still produce a weak result. The review and evaluation surfaces record rules, scores, pass or fail decisions, and repair attempts.
Policy Specialist Is passing a quality review the same as receiving human approval to execute an action?
Runtime Sentry No. Quality review checks the result against configured expectations. Action approval governs authority. Keep both decisions visible, including which evidence and rubric supported a quality verdict.
Lead Architect Now the broader vision: connect run history to decision replay and backtesting, so teams can ask what a proposed change would have done.
Policy Specialist Would replay repeat a payment or an external action?
Runtime Sentry The aim is comparison against recorded evidence without repeating external side effects. Replay coverage is a development direction, not a claim that every action can already be reproduced.
Runtime Sentry Continuous assurance extends that feedback loop. Evaluate outputs, detect regressions, and collect evidence for an improvement.
Policy Specialist Does assurance give an agent permission to rewrite production on its own?
Lead Architect No. Our vision puts proposed fixes through review and governed execution. Assurance should make a decision more informed, not remove the people responsible for it.
Lead Architect Self-healing is a policy-controlled response to sustained drift. Monitoring can stop at observation; other modes can propose or apply an eligible recovery.
Policy Specialist Can every detected problem trigger unrestricted production changes?
Runtime Sentry No. The platform controller checks mode, cooldowns, rate caps, duplicate work, and available rollback targets. Forward fixes draft an improvement for review. Rust orchestration coverage is still evolving.
Lead Architect Learning feedback connects outcomes and observations to the improvement process, so a failure does not disappear after the run ends.
Policy Specialist Does submitting feedback immediately retrain the model or change everyone’s configuration?
Runtime Sentry No. Feedback is recorded input for assessment. Its tenant context, quality, and relevance matter before a proposed change is evaluated and released.
Lead Architect The same business concept can have different terms across industries and regions. Terminology gives that context a place in the catalog.
Policy Specialist Does translating a term establish regulatory correctness?
Runtime Sentry No. Vocabulary helps the agent understand the setting. Domain rules and decisions still need validation. Regional terminology and the regional voices in this discussion are separate features.
Lead Architect Industry packs organize reusable domain configuration so each team does not have to begin from an empty workspace.
Runtime Sentry A pack can provide a starting point for profiles, terminology, and workflow configuration, subject to the capabilities supported by its schema and deployment.
Policy Specialist The vision is one governed engine adapted to many kinds of work. A pack is a starting point to review, not a certification. That is the direction: intelligence with boundaries, and improvement with evidence.
Lead Architect An industry KPI starts with a precise business meaning: which source fields, units, period, and formula should produce the measure?
Policy Specialist Can a plausible number be accepted simply because a model presents it confidently?
Runtime Sentry No. Mapping and grounding connect computation to domain examples and supporting artifacts. Verification checks the stated contract. Industry packs provide a starting point, not universal regulatory certification.
Lead Architect The Copilot is an operator-facing conversation over platform context and supported tools, with voice features depending on configuration.
Policy Specialist Does a conversational request bypass the permissions of the normal interface?
Runtime Sentry No. The caller’s scope and the governed action path still apply. The assistant should explain its evidence and present supported actions without inventing logs, results, or approval.
Lead Architect Foundry helps an operator compose platform configuration and artifacts inside a bounded authoring environment.
Policy Specialist Can it bypass the platform by writing directly to the database or giving itself a broader role?
Runtime Sentry The intended write path is the governed API, under a sandbox profile that narrows the caller. The composer profile excludes tenant knowledge and artifact services from its available scope.
Lead Architect The full direction is a governed capability lifecycle: describe a need, generate an implementation, test it, ground its results, and review the evidence.
Policy Specialist Is generated code ready for production simply because compilation or a sandbox test passed?
Runtime Sentry No. Security review, domain validation, approval, catalog registration, and tenant grants are separate requirements. The end-to-end Rust path remains a development direction, not unrestricted autonomous deployment.
Everything above this line is in the platform today. These six are not — each names the part that already stands and the part still being built, so the boundary between the two is never something you have to ask about.
Inside the platform an agent already brings in another of the company’s agents when a goal needs a specialist — live in goal runs, and bounded: depth, spend and provenance travel with the child run, and the lineage that carries them can only be written by the runtime itself. Calling an agent outside it goes through a governed connector that guards every address it is handed; the connector is built and sandbox-tested, and its first call to a real remote agent is still ahead. Being called by another organisation’s agent — under an authority both sides can check — is designed and not yet built. It is the harder half, because the trust boundary stops being one you own.
DELEGATE → ACROSS A BOUNDARY → STILL ACCOUNTABLEDrift is already detected and proposed for a person to decide. Carrying a repair out automatically is deliberately refused today, because the shape it was inherited in reverts a configuration release every tenant shares — the wrong blast radius for one agent behaving badly. The direction is a heal scoped to the drifting agent's own version, behind an approval somebody configured. That is a decision about how much authority automation gets, so it is being made deliberately rather than shipped quietly.
DETECT → PROPOSE → HEAL WITHIN A SCOPEEvery model call already goes through one governed gateway, scanned pages are read by PP-OCRv5 on ONNX Runtime, and documents are searched by embeddings the platform computes itself — all of it on CPU today. What is not built is running the models, the embeddings and the document reading on GPUs inside your own estate, with NVIDIA NIM and TensorRT-LLM. The same gateway stays in front of them, so permissions, spend ceilings and the ledger apply unchanged, and a prompt need never leave your infrastructure.
CPU TODAY → GPU IN YOUR ESTATE → SAME GATEWAYA tenant registers its own store and the platform resolves credentials from it at call time — served today for HashiCorp Vault, with the isolation, verification and fail-closed behaviour already in place. AWS Secrets Manager, Azure Key Vault and GCP Secret Manager are offered through the same verified path and refused until each is served, rather than approximated in the meantime.
REGISTER → VERIFY → RESOLVE PER TENANTCode the platform writes already runs in its own WebAssembly sandbox — JavaScript and Python alike, with nothing that reaches the host, bounded by instructions rather than wall-clock, every execution journalled with its digests. What is not built is that code calling out: reading through its connectors and the knowledge base under the agent’s own grants, each call journalled, so a replay feeds back what the code saw then instead of calling live systems again.
BOUND → JOURNAL → REPLAY EXACTLYConnectors reach the estate an organisation actually has — databases from Postgres and MySQL to SQL Server, MongoDB and Redis, message queues from Kafka and MQTT to the cloud providers’ own, file transfer, spreadsheets, mail and files, and the line-of-business systems behind them. Each is a versioned manifest that becomes immutable once published, and each passes its sandbox tests before it is offered. Still to come: Oracle, which is listed and not yet served, and certification against a company’s own systems rather than the sandbox alone — through the same port, review and certification path.
MANIFEST → CERTIFY → GOVERNED CALLShort, plain guides to the questions every evaluation reaches — what a governed runtime is, how approvals and audit trails work, and where MCP, A2A and the EU AI Act fit.
A governed AI agent runtime lets AI agents act on real systems only within permissions you set, with human approval for risky steps and a tamper-evident record.
Read the guideHow human-in-the-loop approval works for AI agents: which actions should wait for a person, quorum, separation of duties, delegation and expiry.
Read the guideWhat an audit trail for AI agents must record, why it must be written with the change itself, and how hash chains and signed anchors make tampering detectable.
Read the guideMCP connects AI agents to tools. What can go wrong — over-broad access, tool poisoning, changed definitions, leaked keys — and how to govern it.
Read the guideWhat the Agent2Agent (A2A) protocol is, what it leaves to you — permission, credentials, trust — and how a governed broker makes calling other agents safe.
Read the guideWhat the EU AI Act asks of high-risk AI — human oversight, automatic logging, deployer duties — and what that looks like for AI agents. Not legal advice.
Read the guideUnderstand the architecture, the controls, and the limits before putting agents to work. Several of these answers are “no”, which is the point of asking.
Yes. Creating an account and a company workspace is free. A starting allowance and OpenRouter’s free models let you try real work; when you connect your own AI account, that provider bills you directly. Any paid plan is shown before you are charged.
With Google, with Microsoft, or with your email. Signing up creates your company’s workspace and makes you its administrator; you invite your team from there, and each person gets their own permissions.
Claude, Gemini, OpenAI, Groq and Mistral on your own accounts; OpenRouter for hundreds of models, free ones included; or a model server you run yourself that speaks the OpenAI format. Azure OpenAI, AWS Bedrock and Google Vertex AI are listed but cannot be connected yet. Each job — general, fast, reasoning, coding, vision, speech — is mapped to the model you choose.
Yes — it is built for that: the same services run where your Postgres, Redis, Qdrant and object storage run, in your cloud account or your datacentre, with your identity provider and your own vault. Today it runs hosted at console.a2amatrix.com; the platform page describes what a self-hosted evaluation needs.
A model proposes a tool intent. Assigned capabilities, caller permissions, policy, and any required approval determine whether it can execute. A model response is not itself authorization.
The sandbox primitive runs WebAssembly modules — generated JavaScript and Python — with nothing that reaches the host, and bounded fuel, memory, and execution time; Python’s system calls are answered from memory by the platform’s own host. These limits cover modules routed through it. It is software isolation; it does not mean every agent loop or integration runs in a hardware enclave.
A framework gives you the loop and leaves identity, approval, tenancy and evidence as work for your team — which is most of the work, and the part that decides whether anything reaches a real system. An RPA suite automates the click path and has no notion of an agent proposing something nobody anticipated. A chat assistant answers beautifully and cannot act. This is the layer underneath all three: the permission an action is checked against, the person who is asked when it matters, and the record that survives it. Bring your own models and tools; the platform is what makes letting them act defensible.
Extend it. Agents, workflows, connector assignments and policy are composed through the same APIs and governed surface a person uses — that is the rule the platform’s own foundry follows, and it holds no private path. Tools arrive over MCP, an open protocol, and a connector is a versioned manifest rather than a plugin compiled into a service. The work your team does in it is not held inside a format only we can read.
It runs where your Postgres, Redis, Qdrant and object store run — your cloud account, your datacentre, or a machine under your desk. The one hop that leaves by default is the model call, and pointing that at an endpoint you host removes it; there is no phone-home, and the platform does not need a connection to us to operate. The services are compiled binaries with nothing to warm up; the ones that run speech and OCR models locally need the most memory. The costs that matter in an agent platform are the model calls and the database, both of which are yours and both of which are metered per tenant.
Yes, and both work the same way: a tenant registers what it runs, and the platform resolves against it per call. Provider formats are configuration rows rather than a hard-coded list, so an endpoint speaking the OpenAI chat shape — commercial or self-hosted — is registered rather than coded for. Secret stores register the same way, and the platform refuses a backend it cannot actually read rather than pretending; which kinds are served today is on the direction section, because that is a status and statuses belong in one place.
Start a workspace in a minute, or bring a real enterprise use case and we will map the agents, the integrations, the approval roles, and the people who stay in control.