Documentation

How an agent runs here, what the policy file means, and which promises are enforced by something rather than intended by someone.

Getting started

1. Create an agent. The name becomes its hostname and cannot be reused later, even after the agent is archived — so an old link can never reach somebody else's.
2. Give it a model. Your own provider key, stored encrypted and granted to that one agent.
3. Write a policy. Until you do it is deny *, which is a working agent that cannot reach anything.
4. Connect a channel and message it.

The policy language

Four verbs, one file. The most specific rule that matches wins — not the first, and not the last, so re-ordering the file cannot change what it means.

allow   api.github.com        read write
ask     gmail.googleapis.com  send
deny    *

cap     $2.00 / day hard

• allow — let it through, and record that it happened.
• ask — hold the request open and wait for a person. The agent sees a request in flight, not a refusal, until you answer.
• deny — refuse, with a reason the agent can read and adapt to.
• cap — a ceiling in money, checked before the request leaves rather than reconciled from an invoice afterwards.

Verbs like read and send are resolved from the request itself — the host, the path and the method together — so send on Gmail means sending mail rather than any request that happens to be a POST.

What is actually enforced

The distinction worth caring about is between a promise kept by a mechanism and one kept by intention. These are mechanisms:

• No route off the box. The container sits on a network with no gateway. There is no path to the internet to be misconfigured, because there is no path.
• One way out. A proxy holding your policy, in a namespace the agent does not share and cannot reconfigure.
• A kernel-isolated sandbox. gVisor, so a kernel bug is not a cross-tenant escape. An agent is attacker-controlled code the moment a prompt injection lands.
• A record it cannot edit. Append-only, hash-chained, and the head is signed — so changing an old entry means forging every entry after it.
• Tenancy in the database. Row-level security, enforced by Postgres against the caller's own identity rather than by application code remembering to filter.

Credentials

Stored under envelope encryption — a key per secret, wrapped by a master key that is not in the database and therefore not in any database backup. Granted per agent. Nothing reads one back: the summaries this API returns have no field for a secret, so there is no filter that could be forgotten. The agent's container is the only thing that ever decrypts one.

What is not built yet

Named here because finding out at the moment you need something is worse than reading it now.

• Included model credits. The choice exists in the interface and the spending cap behind it is real, but this deployment does not yet hold model keys to lend. Bring your own.
• Team seats. Accounts are single-owner today.
• A published uptime commitment. There is no status page and no SLA.