Every agent action reaches your systems through Tier Two.
And on the way through, it picks up an identity, a policy decision, a just-in-time approval where it matters, and a signed record.
Follow every agent action from identity to outcome.
Filter the decision timeline by actor, agent, connection, action, identity, or result. Open any denial to see what policy stopped it before a downstream credential was used.
Audit / Action ledger
Every decision in one timeline
Dana
research-agent
query_dataset
finance/kpis · Employee
Dana
research-agent
refresh_schema
production · Elevated
Morgan
build-agent
drop_database
production · Organization
Morgan
build-agent
list_projects
engineering · Organization
Selected denial
drop_database · production
No allow rule matched this action. The call was blocked before any downstream credential was used.
- Actor
- Morgan
- Agent
- build-agent
- Connection
- Metabase
- Event ID
- evt_7ca1
Know every agent in your company.
Your org is the tenant
Teams, members, and admins map to your organization. Admins decide; owners approve.
Agents bound to owners
Every agent belongs to an owner — a person or a team. Ownership routes its approvals and anchors its audit trail.
Devices pair and revoke
Agents sign from paired devices with local keys. Revoke a device and every key on it stops working.
A directory, not a mystery
Every agent in one list: live sessions, latency, denied-call trend, device trust, and what it's allowed to reach.
Enrolling a fleet? Push the client by MDM or hand out an admin-minted enroll secret. Machines enroll without a human, land unassigned, and fail closed — no governed call succeeds until someone binds the device at first sign-in.
Connect your systems. Keep your credentials.
Register the systems agents may reach. For each connection, choose per-user credentials (brokered OAuth or a linked key, so downstream permissions stay the employee's) or one org-provisioned credential that avoids credential setup for each employee.
Agent
device signs the request; no downstream credential on the laptop
Tier Two
policy → identity lane → credential from the sealed vault
Your connection
receives the call with the actor attached
On org-provisioned connections, calls are forwarded server-side: the credential is decrypted only when needed, used in-process to forward the call, and never reaches a device.
Every rule reads as a plain sentence.
Rules are authored with schema-driven pickers over real connections, tools, and resources, and every rule is rendered back as plain prose, so review means reading, not decoding.
Default-deny
No rule, no call. Rules match by connection, tool, and resource; the most specific rule wins, and explicit denies beat everything.
Simulate before you ship
Test a call against your rules before an agent ever makes it, and lint catches rules that can't fire.
Grant routine access. Approve sensitive actions just in time.
Just-in-time approvals
Sensitive actions can require a fresh, one-use approval. Standing grants do not bypass step-up rules, and every decision is recorded.
Standing grants
For the routine, agents request access; an admin decides once and the grant stands until revoked. Requests route to the agent's owner or team.
Know exactly what every agent did.
The action ledger
Every call, allowed or denied, with who, which agent, what action, what resource, and which identity it ran as. Filterable by all of it.
The governance ledger
Every change to the rules themselves: rule edits, grants, credential rotations, and device pairings, each with the actor who made it.
Both ledgers stream to your SIEM: HMAC-signed webhooks or Splunk HEC, three versioned streams, delivered in order and at least once, minutes behind live.
Both sides of the rollout.
For security & platform teams
- One place to see, allow, and revoke everything agents can do.
- Default-deny policy with simulation, lint, and prose review.
- A signed, append-only record for every decision, including the denials.
For the engineers whose agents do the work
- Pair once; your agent works everywhere the org allows.
- No credentials to paste into config files; the gateway carries them.
- When the agent needs more, it asks in-line and a human approves.
Give your agents an identity you control.
Self-serve and free while in beta. Start with one agent and one connection.