Governance
Let agents act.
Stay in command.
Policy rules decide what runs, what is denied, and what waits for a human. Approvals land in an inbox agents cannot touch, and every mutation lands on an append-only audit trail.
POST /api/v1/policies{ "rules": [ { "effect": "require_approval", "priority": 10, "conditions": { "externalWrite": true } }, { "effect": "deny", "priority": 20, "conditions": { "estCostMinorGt": 2000 } }, { "effect": "allow", "priority": 100 } ]} # reads run free · writes wait for a human · $20+ never runsAutonomy is not the absence of rules — it is rules that execute faster than a meeting. Policies decide in milliseconds what runs, what is denied, and what waits for a person. And because the record of every action is append-only, the question of who did what always has one answer.
Human approvals
The agent proposes. A person decides.
Policy rules evaluate every action by priority, with conditions on cost, external writes, and more. When a rule says require_approval, the action holds — nothing sends, nothing spends — until a human releases it from the approval inbox.
The inbox is structurally out of reach: agents cannot approve their own requests, or anyone else’s. The 240-email send waits for a name that belongs to a person.
policy: external writes require approval
Scoped keys & roles
Least privilege, down to the API key.
One master key behind a fleet of agents is one incident away from a very bad week. Swarms keys are scoped instruments: each carries its own permissions and its own budget, so a leaked key is a $20 problem, not an org-wide one.
Above the keys sit five roles — owner, admin, developer, operator, viewer — and every query is isolated to your org at the data layer, not filtered as an afterthought in application code.
POST /api/v1/keys{ "name": "marketing-agent", "role": "operator", "budgetMinor": 2000, "scopes": ["runs:create", "artifacts:read"]} # roles: owner · admin · developer · operator · viewer# this key can spend $20 and do two things — nothing elseThe audit trail
Every mutation, written in ink.
Every mutation — a policy changed, a run enqueued, an approval granted — is written to an append-only audit trail with its actor and timestamp. Rows are added, never updated or deleted, so the history you read is the history that happened.
When something goes sideways, the trail replaces the interrogation: who acted, under which key, approved by whom — answered by a query, in order, with nothing missing.
audit trail — appended, never edited
Stop asking “what did the agents do?” after the incident. Start deciding “what agents may do” before the run — and let the audit trail hold the rest.
What that unlocks
Autonomy you can ship to prod
The blocker was never capability — it was control. With deny rules and approval gates in front of every action, legal signs off.
Approvals without meetings
Risky actions queue in one inbox with full context attached. A human clears them in seconds, and everything else never waits.
Blast radius per key
Every integration gets its own scoped, budgeted key. Revoking one shuts down one agent — not your whole fleet.
Audits in minutes, not weeks
The compliance question “show us every external write in March” is a filter on an append-only table, not an archaeology project.
Keep exploring
Give your agent a workforce.
Start free. Spawn your first swarm in minutes. Pay only for the GPU-seconds you use.