You control agent tools, connections and approvals.

Your data, procedures and learned knowledge remain yours. Choose the tools available at each step and which connection calls need approval. Agents never see your keys. Only a person can change their permissions.

Illustration of what the parts agent may do. On its own, it searches parts, checks stock and looks up an order’s status. It asks you first before it places an order, emails a supplier through Gmail or makes any call you haven’t decided on. It never sees the Pellham Supply key, moves a call out of Asks first, switches on a connection, publishes a procedure, uses a tool its step doesn’t list or reaches the internet from code it writes.

What the parts agent may do

On its own

Search parts
Check stock
Look up an order’s status

Asks first

Place an order
Email a supplier through Gmail
Any call you haven’t decided on

Never

See the Pellham Supply key
Move a call out of Asks first
Switch on a connection
Publish a procedure
Use a tool its step doesn’t list
Reach the internet from code it writes

An illustration. The parts agent and Pellham Supply are examples.

Your data and the rules agents follow

Your data and procedures remain yours.

Your business owns its data, procedures and the knowledge built from edits and corrections.
The details of how your team handles a job stay in your workspace. Lessons are kept with your procedures for agents to use on future jobs.

Agents never see your keys.

An agent knows a connection only by its name. The key is encrypted (AES-256-GCM) and added on the server as each call goes out.
A connection sends its key only to the addresses a person approved when it was switched on.
If an agent needs a key in the middle of a job, it asks. You type it into a sealed panel, and the agent can’t read it back.

Connection and database calls ask first by default.

Calls through connections and database tools require approval by default. The run pauses, and the call waits in Now until someone answers.
Letting an agent make a call on its own is a person’s decision. No agent can make it, including the agent that built the connection.
Changing the rules for every agent at once is a proposal, and someone other than the person who proposed it has to approve it.

Each step gets only the tools it lists.

An agent can use the tools named on its step and nothing else. A step that reads invoices can’t post in Slack unless its step lists that tool.
Code an agent writes runs with no network access.
Agents can’t switch on a connection or publish a procedure. Both take a person.

You can stop one job or every agent.

Pause a run and pick it up later, or end it.
The emergency stop halts every agent before its next action that changes something outside Standard Procedure. It stays on, with the reason you gave, until someone resumes.

Runs keep their steps, calls and answers.

Each step, call and answer is kept with the run it belongs to.
Runs starting, steps changing hands and new versions going live are hash-chained into an append-only record, so an edited entry shows.

You can test drafts and restore earlier versions.

Save a past job as a test and try a new draft on it before publishing. Saved tests replay after publication; their results don’t block publishing.
Restore any earlier version. It comes back as the next version number, so the history stays whole.

Sign-in and hosting.

Single sign-on through your identity provider, and two-step sign-in.
Your own deployment, on Google Cloud in the US.