Agents with real authority, inside your perimeter.
A chatbot that can only read is a search box with worse latency. The value arrives when an agent can qualify the account, price the deal, and update the record — which is precisely the moment your security team gets involved. We built the execution environment that makes that conversation short.
Platform evidence
Architecture
Orchestration is ours. Execution is yours.
The platform splits along a hard boundary. A control plane decides what should happen next. An execution plane, running entirely inside your cloud account, is the only thing that ever touches your data. The two communicate over mutual TLS with distributed trace context propagated across the seam.
- Browser over WebSocket → session UI
- SSO · SAML 2.0 · OIDC → session lifecycle manager
-
INGRESS → GOVERNANCE → ROUTER → SUPERVISOR → EGRESS Tokenization, injection scan, pre-execution gate The router classifies each turn as NEW_TASK, CONTINUATION, META_OPERATION or AMBIGUOUS before anything else runs.
-
AGENT FACTORY Three-way tool intersection platform ∩ tenant ∩ RBAC — emitted as a signed session manifest
-
REASON → ACT → OBSERVE ENGINE Three layers of pre-execution validation, then a human gate on every write
-
REFLECTION EVALUATOR Quality gate, metering flush, two-phase memory commit
- LLM gateway — routing, failover, virtual keys, rate limiting
- Trace sink — OpenTelemetry glass-box audit
- EgressFilterSpec — eBPF rules and a DNS sinkhole
- PII sidecar — scans all stdout before it leaves
- Connected systems over OAuth 2.0 — warehouses, lakehouses, CRM, ticketing, ERP; each added by a YAML manifest rather than a code change
A new goal, so the roster is recompiled from scratch: platform ∩ tenant ∩ your role, signed for this turn. Nothing is inherited from the previous exchange.
A refinement of the previous answer. The manifest is reused and the citations from the prior turn stay resolvable, so “that” still points at a result set the backend can name.
A question about the session rather than the data. It is answered from the signed manifest itself — no tool is called, no warehouse is touched, and the answer cannot exceed what the manifest already says.
“Those” has no referent the backend can resolve, and the action is a write. A router without this state would pick the most probable antecedent and proceed. This one stops and returns a question:
“Do you mean the 12 opportunities from the previous answer, or all 47 in the pipeline? I will not guess on a write.”Context routing
"Now break that out by region" is not a new question.
Most agent frameworks rebuild the entire pipeline on every turn, which is why follow-up questions are slow, expensive, and lose the thread. A semantic router is designed to classify each turn in under 100 milliseconds, picking one of four paths before any pipeline runs.
NEW_TASK
Full compilation
An unrelated request. The factory compiles a fresh agent specification against the three-way intersection of platform, tenant, and role permissions.
CONTINUATION
Cached bypass
A refinement of the last answer. The cached agent specification is reused, subject to a time-to-live and a permissions hash, so the follow-up is near-instant.
META_OPERATION
No pipeline at all
"Export that to slides." A request about the output rather than the data. It never reaches the reasoning engine and costs nothing in inference.
AMBIGUOUS
Ask, do not guess
Intent is genuinely unclear. Rather than burning a pipeline on a guess, the agent surfaces a clarification card and waits for the human to disambiguate.
Working memory persists across turns under a two-phase commit: a draft accumulates during the turn and is promoted only when the turn completes successfully. A failed turn leaves no partial state behind, so the next question starts from a coherent context rather than a half-written one.
Data exploration
You cannot paste 50,000 tables into a prompt.
Every demo works against a schema with twelve tables. Real enterprise catalogs have tens of thousands, and the standard approach — dump the schema into context and hand the model a single query tool — collapses immediately on cost, latency, and accuracy.
So the agent explores instead of ingesting. Retrieval surfaces the handful of relevant tables. A probing tool suite then previews, counts, aggregates, and text-searches them the way a competent analyst would before committing to an expensive query.
The pointer pattern
When a result set exceeds the threshold, the connector materializes it to object storage and returns a pre-signed URL. The model receives a reference and a summary — never the raw rows. Cost stays bounded regardless of how large the answer is, and the sensitive payload never enters a context window.
catalog: 50,000+ tables · 0 injected into context
1 discover_schema("revenue by account, Q3")
→ 7 candidate tables, ranked
2 preview_table("fct_opportunity", n=5)
→ 22 columns, 3 date grains found
3 count_rows("fct_opportunity", filter=Q3)
→ 1,284,905
4 text_search("stage", distinct)
→ 9 stage values, 2 deprecated
5 aggregate(group=account, metric=arr)
→ 84,112 rows > threshold
→ materialized to object store
→ pre-signed pointer returned
rows seen by the model: 0
Provenance
The model does not get to write its own citations.
Asking a language model to cite its sources is asking the thing that hallucinates to certify that it did not. Citations are generated deterministically by the backend from the actual tool-call record, then reconciled against the narrative. Markers the model invents are stripped before anything renders.
FAILURE MODE 01
Prompt bloat
Naive citation schemes push the full source payload into the prompt so the model can reference it. Ours never does — the backend already holds the mapping.
FAILURE MODE 02
Invented markers
A model that has learned citations look authoritative will produce them unprompted. Any marker without a matching tool-call record is removed.
FAILURE MODE 03
Cross-turn amnesia
Citations that reset each message make a multi-turn analysis unauditable. The bibliography accumulates across the session instead.
FAILURE MODE 04
Deep-link injection
A citation that renders as a clickable link is an egress channel if the URL is attacker-controlled. Destinations are validated against an allowlist before rendering.
Integration
A new system is a YAML file, not a release.
Connecting a warehouse, a ticketing system, or an ERP should not require a sprint. Connectors are declared as manifests: the layer discovers the tool schema at runtime and injects it just in time, so adding a system is a configuration commit reviewed like any other change.
Six hardening layers sit underneath, each closing a specific attack against tool-using agents.
Fail-closed shadow-tool suppression. A malicious server cannot register a tool that impersonates a trusted one. Name collisions resolve by denying, never by guessing.
Description-injection defense. Tool descriptions are untrusted input. Instructions smuggled into a tool's own description cannot redirect the agent's behavior.
Idempotency-aware retry guards. A transient failure on a non-idempotent write does not silently become a duplicate transaction on retry.
Just-in-time schema injection. Tool schemas enter the context only when a tool is about to be used, which keeps a large connector roster from consuming the window.
AST-parsed query validation. Generated queries are parsed into a syntax tree and checked structurally, so subquery nesting cannot smuggle past a rule that only reads strings.
Schema-pinned approvals. A human approval is bound to the exact schema and plan it was granted against, so it cannot be replayed after the underlying definition changes.
What ships in the platform
Not a roadmap. These are built, tested, and running.
| Layer | Capability |
|---|---|
| Identity | SAML 2.0 and OIDC ingress (Azure AD, Okta, custom), with key-management-backed token storage. |
| Authorization | Three-way tool intersection — platform capability, tenant entitlement, and user role — compiled into a signed session manifest per turn. |
| Privacy | Context-aware tokenization before transmission with re-injection after response, governed by a declarative per-tenant policy: category allowlists, custom identifier patterns, known-safe denylists, and skip-context rules. |
| Threat defense | Wire-speed prompt-injection scanning at ingress, plus a three-layer pre-execution gate that validates every proposed tool call before dispatch. |
| Observability | End-to-end OpenTelemetry tracing with W3C trace context propagated across the control/execution boundary, giving a glass-box record of every agent action. |
| Human control | Approve / reject / escalate on every write, with a blast-radius diff preview and an optimistic-concurrency token that blocks replay against a modified plan. |
| Deployment | Docker, Kubernetes and Helm for on-premises or BYOC, a signed single-binary desktop build, or managed cloud — the same codebase in each topology. |
| Commercial | Outcome-based metered billing through AWS and Azure Marketplace with idempotency guards, so procurement can transact through an existing cloud commitment. |
FAQ
What security architects ask.
In hardware-level MicroVMs inside your VPC — never a shared host. Each sandbox uses a hardware-level hypervisor for hypervisor-grade isolation, carries an eBPF egress filter and DNS sinkhole restricting outbound traffic to your allowlist, and runs a sidecar that scans all output for personal data before it leaves the sandbox.
Defense at four layers, because no single one is sufficient. Wire-speed injection scanning runs at ingress; tool descriptions are treated as untrusted input so instructions hidden inside them cannot redirect behavior; a three-layer pre-execution gate validates every proposed call before dispatch; and the egress filter means even a fully compromised agent has nowhere to send anything.
A YAML manifest, not a code change. The connector layer discovers the tool schema at runtime and injects it just in time, so a new warehouse, ticketing system, or ERP is a configuration commit that goes through your normal change review. The six hardening layers apply automatically to anything declared this way.
The full causal chain, not a summary. Every agent action is traced end to end with W3C trace context propagated across the control and execution planes, so an auditor can reconstruct which turn triggered which tool call, what it returned, who approved the resulting write, and against which version token. Citations in the narrative resolve to those same records.
Yes — Kubernetes and Helm, Docker Compose, or a signed single-binary desktop build. It is the same codebase in every topology, so choosing on-premises does not put you on a lagging feature branch. Inference routes through whatever gateway your organization already approved rather than a path we impose.
Bring your security architect to the first call.
Most vendors want to talk to the business sponsor and defer the security conversation. We would rather have it first, because the deployment topology is the product decision. Bring the questionnaire.
Written on this
The engineering behind it, in detail
Playbook
Deploying an Agent Against Databricks Unity Catalog
Schema injection collapses somewhere past a few hundred tables. A narrow probing tool set, retrieval-driven discovery, a pointer pattern for bulk results — and the three failure modes that only appear once a real catalog is behind it.
Comparison
LangChain and LangGraph in an Enterprise Deployment
An orchestration library is not an alternative to a governed system — it is a component inside one. Twelve decisions the library leaves to you, and when owning them is the right call.
Comparison
Microsoft 365 Copilot and the Work It Does Not Do
An assistant and a governed execution substrate are not competing for the same budget line. The boundary sits exactly where an action stops being reversible — and inheriting a permission set is not the same as intersecting one.
Comparison
Building It In-House: What the Estimate Leaves Out
Many organisations should build this, and the ones who should not are identifiable by one property of the work. The demo is the first fifth; the substrate is the rest, and it cannot be retrofitted onto a prototype that already works.
Comparison
CrewAI and AutoGen Against Enterprise Constraints
Coordination frameworks solve delegation well. Delegation is also how an injected instruction escalates privilege, and agent count is a design cost rather than a capability.
Teardown
Teardown: The Pre-Execution Write Gate
Policy the model cannot read, a tool roster compiled per turn, and a rendered blast-radius diff pinned to a version token. Three checks in the execution path, and the throughput ceiling they buy.
Teardown
Teardown: Deterministic Citation Provenance
The model writes the answer; the backend decides what it may point at. A grounding critic, marker resolution against the execution record, and why rendering a citation is a security boundary.
Architecture
Human-in-the-Loop That Actually Holds: Write Gates, Blast Radius, and Replay Protection
Most human-in-the-loop is a confirmation dialog. Three properties separate a real approval gate from a checkbox that manufactures consent.
Engineering
How an Agent Queries a 50,000-Table Warehouse Without Reading the Schema
Every demo works against twelve tables. Real catalogs have tens of thousands, and the standard approach collapses on cost, latency, and accuracy at the same time.
Strategy
Build, Buy, or Assemble: Sourcing Enterprise AI Capability
The build-versus-buy framing hides the option most enterprises actually need, and the three constraints that decide it have nothing to do with engineering capacity.