The control layer between agents and infrastructure.

Ingress sessions, workflows, scheduled jobs.

Deterministic host-side automation: helper calls, capability calls, transforms, and the model invoked as one bounded step rather than the thing driving the program.

chat · session

• —Persisted ingress session history
• —Cron-style scheduling with run history
• —Model decisions as explicit steps

Constrained capability runs, scoped per invocation.

Every capability invocation is its own process with its own limits. Filesystem access is restricted to explicit read, write and exec paths; the process runs under no_new_privs with seccomp filtering and Landlock restrictions.

• —One process per invocation
• —Explicit path allowlists, not ambient access
• —Resource limits set before the call, not after

Host-managed helpers and curated skill delivery.

Helpers and skills are catalogued and attached by the host, so an agent receives a tool contract rather than a credential. What the agent can reach is a decision you record, not something it discovers.

• —Reusable host-managed integrations
• —Skills installable into agent context
• —Structured capability definitions

Network filters, firewall evaluations, sandbox rules.

All guest network traffic routes through a host-controlled proxy. Domain rules support default-allow or default-block, and host.internal exposes only the routes you permit.

• —Dual-boundary LLM safety firewalls
• —Default-allow or default-block egress
• —Temporary scoped credentials per invocation

Centralised logs and usage records.

Fourteen log domains recording token accounting, firewall verdicts, proxy traffic and document-level retrieval — written as a by-product of running the system, not as an integration project.

• —Queryable per resource
• —Token spend per agent, workflow and model
• —Retrieval recorded at document level

Judged before the agent sees it.

A guardrail runs before the user message reaches the agent's model. Safe continues; unsafe stops the request and returns your refusal message. An evaluation that fails does not quietly pass — the control fails closed.

Guardrails are reusable policies, attached per surface: Internal Chat, WebWidget, API and the OpenAI-compatible endpoint, and Content Processing, which inspects untrusted tool output before it re-enters the loop.

• —Internal — a deterministic injection scanner plus a locally hosted Llama Prompt Guard 2 classifier. No external inference call.
• —Generic Judge — your policy in natural language, evaluated by any OpenAI-compatible model.
• —Llama Guard and ShieldGemma — for deployments already running a compatible safety model.

The internal classifier runs in a platform-managed Rust sidecar: INT8 ONNX weights through RTen, CPU-only with AVX2 and AVX-512 kernels, overlapping windows past the 512-token context, and no runtime network dependency. Every verdict is recorded with its reason, categories, risk score and execution time.

firewalls · new policy

Data lineage without a documentation project.

What entered the prompt, what was retrieved, what the model returned, which tools ran, what it cost — recorded as a by-product of operation.

Article 50 transparency duties take effect 2 August 2026. Annex III high-risk obligations now run to December 2027, which means you are building an architecture rather than buying a patch.

Three roles underneath. Admin configures and administers. Operator sees the whole system and chats with every agent, but changes no security-sensitive configuration. User reaches only explicitly assigned agents and granted knowledge bases.

Decisions are enforced on the server for every protected route, not by hiding buttons. Access changes revoke the affected user's sessions, the last enabled admin cannot be demoted or deleted, and each change writes an authorization record with actor, action, target and outcome.

settings · access

Everything sensitive stays on the host.

• —Provider API keys and integration secrets stay on the host
• —Secrets encrypted at rest, gated by a master key
• —Host GUI uses session auth and CSRF protection for browser mutations
• —Orchestration, policy decisions, tool attachment and audit logging all happen host-side
• —DataLake datasets carry a classification and become bounded, read-only query tools — no raw export, no unrestricted SQL

Capability runs are boxed in.

• —Capability runs are constrained per invocation
• —Filesystem access restricted to explicit read, write and exec paths
• —no_new_privs, non-dumpable process state, seccomp filtering, Landlock restrictions, resource limits
• —One process per invocation

One path out, and you rule it.

• —All guest network traffic routes through a host-controlled proxy
• —Domain rules support default-allow or default-block
• —host.internal exposes only the routes you permit
• —Capability invocations receive temporary scoped credentials

Redacted before it reaches the reader.

An outbound filter runs after generation and before delivery, replacing detected identifiers with explicit placeholders — [REDACTED_EMAIL], [REDACTED_PERSON_NAME] — while the meaning and structure of the answer survive.

With a filter active the response is buffered rather than streamed, so no unfiltered fragment escapes ahead of it. Only the sanitized text is delivered, stored and audited. If the filter fails, delivery fails closed.

• —Deterministic first pass with format and checksum validation: email, IBAN, PESEL, US SSN, Luhn-checked card numbers, phone, IPv4
• —Then a multilingual XLM-RoBERTa token classifier across all 24 official EU languages for names, addresses and organizations
• —Offline in the same Rust sidecar — no network access, and the sidecar logs no request text
• —Or delegate semantic redaction to a configured model, if the provider's residency terms suit you

PII filtering is a risk-reduction measure, not a certification. Detection quality depends on language, context and input, and it belongs alongside data minimization, access control and retention policy.

Know it before finance does.

Token spend logged per agent, per workflow, per model. You know which use case is expensive before finance does.

DataLake queries and Data Product calls are logged the same way, tied to dataset version and build — so a recommendation's cost is as traceable as a chat turn's.

logs · token spent

Reserve frontier for what earns it.

Route the routine majority to small or local models and reserve frontier capability for the fraction that earns it. Reported blended savings for tiered routing run from 40 to 80 percent against frontier-only.

The agentic loop is where budgets die.

Cap the number of model calls per task. Force summarise-and-stop after N turns. The agentic loop is where budgets die.

Set the ceiling, not the invoice.

Reasoning tokens bill as output. Set the ceiling per agent rather than discovering it on the invoice.

Models attach per agent, not globally.

Provider and model attach to the agent, the workflow, the capability — not to a global setting. Data classification decides which model each agent is allowed to call, and the same binding governs which agents may query a DataLake dataset or Data Product.

settings · providers

Local open weights, first class.

Run open-weight models on your own hardware alongside hosted frontier, behind one policy boundary. Any OpenAI-compatible endpoint: vLLM, Ollama, LocalAI or TGI.

agents · llm model

Designed in, not improvised at 2am.

A second provider is a configured fallback, not an incident you improvise through during an outage.

Deterministic automation.

Deterministic host-side automation with helper calls, capability calls, transforms and optional model decisions.

agents · agent flow

Host-side retrieval.

Host-managed document ingestion and retrieval. Retrieval happens host-side, not in the guest.

knowledge · new base

Chat endpoints with persisted history.

OpenAI-compatible chat endpoints with persisted session history, model bindings and attachable policy.

Host-managed integrations.

Reusable host-managed integrations — search, HTTP, SSH, page reading, browser automation, scratch filesystem.

Installable context.

Catalogued host skills installable into agent context, some exporting structured capability definitions.

Constrained execution.

Constrained tool execution with argument schema validation and explicit path, network and sandbox controls.

Cron with history.

Cron-style scheduling for workflows and agent prompts, with run history.

Versioned analytical data.

Tabular data under the same host governance as knowledge and secrets. Built on DuckDB, DuckLake and Parquet: datasets carry a SQL slug and an upload history, and each published version stays queryable.

Data products sit on top — an Association Recommender, for instance — and attach to an agent so it can query them at chat time without the data leaving the host.

datalake · dataset

Read the DataLake walkthrough →