Capabilities
Safe tools only. No raw shell. Every call classified.
The policy engine resolves a risk level per call: low runs immediately, medium needs approval unless the environment auto-allows it, high always waits. Prod, deletes, IAM, schema changes and client sends are high.
Tool catalogue
What the agents can touch.
| Tools | Default risk | Purpose |
|---|---|---|
| env.registry · aws.accounts · aws.inventory | low | Read the environment and account registry, list resources |
| aws.describe · aws.cost · cloudwatch.logs | low | Describe services, read cost explorer and logs |
| github.read · sandbox.run · sql.read | low | Read repos, run untrusted code without network, read-only SQL |
| semgrep · gitleaks · trivy · checkov | low | Static, secrets, container and IaC scanning |
| pptx.build · xlsx.model · pdf.export · gmail.draft · slack.post | low | Produce artifacts and drafts |
| aws.deploy · aws.rollback · ssh.safe_action | medium → high in prod | Change running systems; allowlisted SSH commands only |
| github.branch_pr · gcal.schedule · nuclei.scan · zap.scan | medium | Open PRs on branches, schedule, dynamic scans on authorised targets |
| gmail.send · zendesk.update | high | Anything that leaves the building |
Beyond tools
Workflows, knowledge and memory.
Agent-to-agent collaboration
Handoffs, requests and results are persisted messages. Bounds: depth ≤ 3, ≤ 60 messages per task, ≤ 2 retries per step, step timeout 5 min.
Knowledge base
Runbooks and uploaded documents, chunked and embedded. Retrieval is scoped to global + the task’s environment or account.
Durable memory
One to three memories per task (facts, lessons, skill proposals) with retention policies and XP for learning.
Routines
Cron from agent YAML: daily fleet report, weekly security audit, Monday growth report — runnable on demand.
See the office running
Sign in to the portal — in DEMO mode everything runs end-to-end without cloud keys.