CEO
Set the agent infra standard before every team picks a different stack. Private first. Govern usage. Distribute what becomes durable.
agent infrastructure
Deploy. Secure. Scale.
Governed agent execution at production scale. Identity, separate microsandbox code execution, scoped authority, files, approvals, receipts, replay — one platform, enterprise controls.
private agent cloud
live
L4Distribution
private registry · partner · publicL3Operations
receipts · evals · replay · tracesL2Runtime
sandbox · workspace · grants · approvalsL1Identity
AgentCard · skills · auth · pricingyour agent
one service surface · A2A + MCPprivate→proven→distributedswitching cost compounds with governed work
controls
The primitives teams ask for after the demo works.
Private registry
Internal agents stay private. Promote selected ones to partner or public surfaces when ready.
Managed runtime
Agents run as services with isolated execution, readiness checks, release history, and infra ownership.
Secure execution
Sandboxed runtime keeps code-running work behind a hardened boundary and explicit file grants.
Persistent workspaces
Files, memory, artifacts persist. Inspect exactly what changed.
Approval workflows
Human gates for file expansion, sensitive actions, bounty selection, production handoff.
Observability + evals
Receipts, traces, replay data, scores, review notes tied to each agent.
A2A + MCP access
Expose agents to tools, other agents, Claude Code, Cursor, APIs, customer workflows.
Billing + ledger
Usage, receipts, pricing, monetization paths for partner-facing agents.
Private registry·Managed runtime·Secure execution·Persistent workspaces·Approval workflows·Observability + evals·A2A + MCP access·Billing + ledger·
audience fit
Different buyers. Same infrastructure bet.
Engineering leader
Move agent work out of notebooks into services with deploy history, runtime boundaries, observability, files, approvals, reproducibility.
Revenue leader
Turn repeatable customer work into agents with proof: inputs, artifacts, scores, receipts, review notes, pricing.
pilot motion
Start with one real internal agent.
Fastest credible proof is not a marketplace launch. It is one production-grade private agent with real files, real approvals, real artifacts, signed event history you can inspect.
0–0
production-like tasks
0
private agent
pilot runbook5 steps
- 01Pick one internal workflow with real files and a clear acceptance test.
- 02Deploy a private agent with scoped workspace access and approval points.
- 03Run 20–50 production-like tasks with receipts, evals, replay data.
- 04Promote the agent into an internal registry once run history is strong.
- 05Expose through MCP, API, or A2A handoff only where it creates leverage.
$
for enterprise buyers
The six questions security asks first.
CTO, CIO, Head of AI, Head of Platform, Head of Security — here are the answers, with deep links to the architecture pages.
How is this governed?
Grant-backed delegation and managed workspace operations can use ephemeral, audience-bound, glob-filtered authority. Hosted agent processes may also have separately configured secrets and local runtime access. Approval records remain distinct from signed execution receipts.
Zero Trust runtime →How is this isolated?
Hosted skill code runs in a Knative or Kubernetes container. Code sent explicitly through ctx.sandbox runs behind a separate libkrun virtualization boundary, with grant-aware workspace paths enforcing scoped patterns. Per-agent secrets may be projected into the hosted process, and the repository does not claim absolute no-network or no-escape guarantees.
Isolation model →How is run history inspected?
The control plane signs and persists authenticated Agent API calls, while trusted ingress signs public /invoke and standard MCP tools/call executions. Agent API receipts bind user:{id}; gateway caller values are conservative anonymous, credential-present, or verified grant-issuer classifications. Gateway replay is a minimal transport timeline, not a full internal event trace.
Replay architecture →How is this audited?
Receipts are cryptographically tied to the observations supplied by their sealing path. The schema supports input hashes, grant IDs, file ops, tool calls, eval scores, and review notes; optional fields may be empty. Verified records are queryable and exportable for SOC2 / ISO 42001 / EU AI Act evidence packs.
Receipt anatomy →How is this deployed?
One command — `a2a deploy`. Source is packaged, built, pushed to a managed registry, released to a hosted endpoint with health checks. Versioned, rollbackable, release history preserved. Private agents stay behind org auth.
Deploy lifecycle →How is this authenticated?
Each agent publishes an AgentCard at /.well-known/ and resolves through a platform-managed deployment identity. Supported delegated calls can carry signed grants; formal A2A routes remain protocol state. Users authenticate to the dashboard and API through account identity and org-scoped sessions.
Identity model →