Each service has a room, with its drawing, its replay and its numbers, and a guide with the full story. Every one is Apache-2.0 and installs on its own.
One room over all of it, in your browser, on your own box.
The control room over all of it, in your browser on your own box.
What it may spend, and the switch that stops it.
Runtime spend control and the in-line kill switch.
A crew of agents takes your cloud bill apart, a person signs it off.
The kill switch on a device the agent's host never touches.
Who it is, what it may do, who signs the big things.
Policy decisions with a human in the loop.
One identity graph for humans, keys and agents.
Agents reach the web through a decision, not around one.
A delegation an agent can prove it holds, and a person can end.
What it did, written so nobody can quietly change it.
Cryptography inventory and post-quantum risk.
Signing keys held apart from the code that uses them, and a read-only witness of the record.
Cost per correctly resolved case, not per token.
A typed answer with a probability, never a guess.
Fire drills that prove guardrails hold.
A record nobody can quietly change or shorten.
Every request carries an Agent Passport. An agent has two ways out, not one: a call to a model, and a fetch of something on the internet, and each has a gate standing in it. Below, memory, identity, crypto, quality, rehearsal and alerting read the same NDJSON stream off-path. Nothing here is a dashboard after the fact: the gates enforce in-line, in seconds.
New to this? The guides are grouped by what you came for: where to start, how the stack is secured, the practice of running agents, from governance to FinOps for AI, each service in depth, and what changed in October. Every room above links its own guide, and the stack in depth holds the rest of this page.
“Your AI agents are employees. You just forgot to onboard them.” Tania Fedirko, FinOps Expert, on why this stack exists
Every part of this stack is Apache-2.0, the console included, and that is not a marketing posture. These services decide what an AI agent may do: what it may spend, which tools it may call, whose authority it acts under, and what evidence exists afterwards. A control whose entire job is to remove the need for trust cannot itself be a thing you take on trust.
Governance is the set of controls that decide what an agent is allowed to do while it is running: a budget it cannot exceed, a policy it must ask before acting, an identity that records who it acts for, a memory that can say where a belief came from, and evidence an auditor can verify afterwards.
No. Every plane runs on infrastructure you own: AWS, GCP, Hetzner, any cloud or on-prem, and on-prem is measured rather than merely allowed: on 2026-09-17 the whole stack ran on a small box behind a home router, governing agents in AWS and GCP at the same time. We never run your control plane, hold your keys or store your traffic, so there is nothing on our side to subpoena or breach.
Nothing, and no account. Every part of it is Apache-2.0, the console included. One command builds and starts the long-running services locally: see run the live stack locally. The four that are libraries and CLIs each carry a one-line try-it on their own page.