The layer your security review is looking for. A policy engine evaluates every tool call, approvals are enforced at runtime and spent after one use, PII and prompt injection are screened by policy, spend has hard ceilings, and every action lands in an immutable, exportable audit trail — pinned to the exact configuration it ran under.
In a pack, governance arrives on: permissions, approval gates and the audit ledger active from run one.
See Solution Packs →
A model can be talked out of a plan. It cannot be talked past a gate that sits in the execution path. Every control on this page is enforced where the action happens — on the tool call, at runtime, with the verdict recorded.
That's the difference between a policy document and a policy engine. One asks the AI to behave; the other makes misbehavior a no-op. And because the controls live in the runtime, they cover every entry point the same way: chat, schedule, trigger, API, mobile, MCP client.
Scope what it touches, screen what it reads, gate what it writes, cap what it spends — and keep a record of all of it, forever pinned to the config that produced it.
Governance here is not a PDF your vendor emails you. It's a policy engine that sits between every worker and every tool: rules with a priority order, conditions on the integration, the exact function and whether it reads or writes, and five possible verdicts — allow, deny, require approval, alert, or log. Every evaluation is recorded, including the ones that allowed.
The platform ships a catalog of 1,095 integration functions across 50 integrations, each with a human-readable name and a read-or-write classification. When you write a policy, you pick the exact functions it governs — 'Send email', 'Approve merge request', 'Delete row' — instead of guessing at wildcard patterns and hoping they match.
Most platforms check permissions when a plan is written. This one also checks at the moment each tool call executes — a runtime authorization floor underneath everything. A write that was never approved doesn't run, even if a clever prompt, an injected instruction or a misbehaving model put it in the plan. And every approval is single-use: it releases exactly one action, then the next one asks again.
Autonomy is not a switch, it's a dial with four positions: human-in-the-loop, supervised, bounded, full. Each AI employee carries its own scope, with hard caps on actions per turn, and moves up only when its record earns it. Widening autonomy is one change; narrowing it back is one change too — and both are versioned.
Two policies watch the data itself. A PII policy detects emails, phone numbers, SSNs, card numbers, addresses and names in what agents read and write, and masks, hashes, removes or flags them — your choice, with allowlists for the exceptions. A prompt-injection shield scans untrusted content — tool results, knowledge chunks, table rows, webhook payloads — before it re-enters a model's context, and flags, wraps or blocks anything that looks like an instruction.
Budgets are hard caps, per day or per month, per workspace, employee or team. The platform forecasts spend against the period and shows the breach date before it happens. Circuit breakers watch cost and error thresholds live and auto-pause a worker the moment one trips — a runaway loop burns a ceiling, not a quarter's budget. Critical halts page the right people even through quiet hours.
Every run and every tool call lands in the audit trail: inputs and outputs sanitized, PII flagged, read-vs-write classified, filterable by worker, integration, user and date. And because configuration is immutably versioned, each run is pinned to the exact configuration it executed under — so 'what was this agent allowed to do on March 3rd' is a lookup, not an argument.
Every object in the platform is scoped to an organization and a workspace — data, workers, policies, budgets, audit. Inside the org, a single authorization matrix decides what each role can do: Owner, Admin, Builder, Member, one role per person, every API check answered from the same matrix. Groups share access to specific resources without escalating anyone's authority, and SSO, 2FA and session limits sit underneath it all.
Follow a single consequential action — an AP agent releasing a vendor payment — through the layers it crosses. Not a workflow you configure step by step; this is what the runtime does, every time, on its own.
Six rule types, five verdicts, priority-ordered and versioned. Evaluated on every tool call; every evaluation logged.
1,095 functions across 50 integrations, named and read/write-classified, so policies bind to exactly what you mean.
Writes gated at execution time. Approvals are single-use grants that expire; unapproved steps cannot run.
Four scopes per worker, human-in-the-loop to full, with hard per-turn action caps. Reversible in one move.
PII detected and masked, hashed, removed or flagged. Untrusted content screened before it reaches a model.
Hard daily and monthly caps with breach-date forecasting; breakers auto-pause a worker when a threshold trips.
Every run and tool call recorded and sanitized, each pinned to the exact config version it executed under.
How long run data, audit records and conversation history live is a policy you set, not a vendor default.
End-to-end procurement operations solution pack with vendor registry, purchase request review, contract path assessment, embedded review team, and AI employee coordination.
Complete operating system for a Chartered Accountant practice. Tracks clients, engagements, statutory deadlines, and IT/GST notices. Includes AI agents for notice triage, GST reconciliation, filing reminders, and client communication. Comes with an AI Employee (Priya) who coordinates compliance work end-to-end.
Move candidates faster without cutting corners on fair hiring. Riley, your AI recruiting coordinator, screens each new candidate against the job's must-haves with must-have-by-must-have reasoning, coordinates interview scheduling by drafting availability requests, drafts honest candidate outreach and status updates, builds submittal packages for hiring managers or clients mapping experience to requirements, and gives the team a daily pipeline read. Screening never considers anything beyond skills and qualifications, and it never rejects a candidate or extends an offer; those stay human decisions. Everything else is draft-and-approve: candidate messages are prepared for a human to send, and interview times are proposed, never confirmed, by the agent. Four tables hold your job orders, candidates, interview scheduling, and pipeline metrics. A knowledge base holds your screening standards, submittal format, communication voice, and compliance guardrails, which every assessment and message follows. Automations included: new candidates are screened on arrival, plus an optional daily pipeline digest. Works out of the box with the roles and candidates you add; connect an ATS or job board later to sync candidates, and Gmail and Calendar to send outreach and confirm interviews from the platform. Best first step: replace the placeholder screening standards and compliance rules with your own and add an open job.
A complete outbound-to-pipeline sales engine for a small team. Define your ideal customer profile once in the ICP Profiles table and paste your product details into the Product Knowledge Base, then Sasha, your AI SDR, discovers and vets target accounts, enriches prospects, researches companies, scores leads, and drafts outreach, all grounded in your data. Inbound leads and your deal pipeline live in tables the founder can watch. Automations included: new prospects are auto-enriched on arrival, and an optional daily discovery run finds fresh accounts from your Active ICP. Requires an LLM provider plus the Apollo, Serper, Exa, and Google Search connectors. Replace the sample knowledge base content and the example ICP row with your own.
Answer more support tickets, faster, without losing the human touch. Sam, your AI support specialist, classifies every incoming ticket by category, sentiment, and priority, drafts an accurate reply grounded only in your knowledge base, and escalates anything it is not confident about instead of guessing. It matches recurring problems to approved canned responses, mines new tickets into known issues so answers stay consistent, tracks the feature requests buried in tickets, and produces a weekly insights digest of volume, deflection, and top drivers. Everything is draft-and-approve: replies are prepared for a human to review and send, and sensitive tickets (anger, churn, refunds, account deletion, legal or privacy) are always escalated. Four tables hold tickets, known issues, feature requests, and daily metrics. A knowledge base holds your help-center content and support voice, which every reply cites. Automations included: a reply is drafted the moment a ticket arrives, plus an optional daily sweep of anything still unanswered. Works out of the box with no external tool; connect Gmail later to send from the platform and Slack for the digest. Best first step: replace the placeholder knowledge base with your real help-center articles or URLs.
A complete, full-lifecycle sales engine for a growing team, spanning outbound prospecting and account management across one shared data layer, with a companion inbound concierge. Outbound: Sasha, your AI SDR, discovers and vets accounts, enriches prospects, scouts buying signals, researches companies, scores leads, and drafts cold email, LinkedIn, and nurture outreach. Account management: Maya, your AI Account Manager, qualifies opportunities, drafts and reviews proposals, flags pipeline risk, forecasts renewals and expansion, and keeps the CRM clean. Seven tables hold ICP profiles, target accounts, prospects, website leads, CRM contacts, opportunities, and customer accounts. Automations included: new prospects are auto-enriched on arrival, and an optional daily discovery run finds fresh accounts from your Active ICP. For the inbound engine, install the companion Website Sales Concierge team template, which routes visitor questions to product, pricing, and objection specialists and captures leads into the Website Leads table. Requires an LLM provider plus the Apollo, Serper, Exa, and Google Search connectors. Replace the sample knowledge base content and the example ICP row with your own. Outreach and proposals are drafted for a human to review and send.
