Governance and Security¶

Trust nothing by default, and record everything that happens anyway.

Zero secret exfiltration¶

Agents never hold secrets. On credential creation you pass a temporary placeholder that is resolved at runtime, so the model never receives the real value. A prompt injection cannot leak what the agent never received. In the self-hosted build a sidecar proxy intercepts outbound requests and substitutes the reference with a value fetched from the secret store.

sequenceDiagram
    autonumber
    participant A as Agent
    participant P as Injection proxy
    participant V as Secret store
    participant T as External tool

    A->>P: Request with a placeholder
    Note over A: The agent never held<br/>the real credential
    P->>V: Resolve the placeholder
    V-->>P: Real secret
    P->>T: Request with the real secret
    T-->>P: Response
    P-->>A: Response
    Note over P,T: The swap happens outside the agent,<br/>so a prompt injection has nothing to leak

Dynamic skill creation¶

AgentZ can generate a reusable skill out of a workflow you already ran, so the second person to need that job does not rebuild it.

Tool-level permissions and approval gates¶

Roughly 6% of teams want full automation. The rest want to confirm before an action runs, so the default is to suggest a next step rather than remediate automatically. See Connecting Integrations for the three permission levels.

Workspace-level compute delegation¶

An Enterprise feature. TODO: what an admin delegates, and to whom.

Audit logs and observability¶

Every tool call, memory read and model response is recorded with a deterministic replay id. An auditor can replay any run exactly as it happened. Egress is recorded by domain, port and protocol, allowed or blocked, so nothing leaves without a record.