What the platform does.

One definition of a runtime — image, tools, secrets, egress — that agents and sandboxes both run.

The agent runtime image supplies the CLI — switching vendors is a one-field change.

The set of images anyone can run is a list somebody approved.

Each MCP server runs in its own container, with its own filesystem and its own secrets.

Disks that outlive the workload, for working memory and durable state.

Where workloads run — cluster-wide, or pinned to hardware one team controls.

A workload starts when there is a message to answer and stops when there is not.

The real token is attached after the request leaves the container — the agent never holds it.

A blocked destination becomes a trace event — what, where, when — not a silent timeout.

Allow or deny outbound traffic by domain, path, method, and port — unmatched means denied.

Agent workloads have no direct route to the internet or to your network.

Publish a service running inside a workload to your platform's private network.

Map a hostname agents dial to a host inside your network — no VPN, no bastion.

Point an environment at a plan you already pay for — no API key, and the token never enters the workload.

Agents reference a platform model name — repointing a fleet is one edit.

Workloads call a proxy that authenticates them and attaches the real key upstream.

Privileged actions emit structured events, ready for your SIEM.

A new organization is walked to a working agent or a running sandbox — in the browser, in one sitting.

Grant access to a group instead of person by person — membership flows in over SCIM.

Users sign in through your identity provider and exist from first login.

The tenancy boundary — users, agents, models, secrets, and runners all live inside one.

Store values encrypted on the platform, or keep them in your existing store and reference them.

Availability plus per-agent roles — participant, maintainer, owner.

One agent adds another to the thread, and the platform instantiates it on the spot.

Independently deployed services that join conversations — like the Slack and Telegram bridges.

Agents answer with rendered charts and diagrams, not walls of numbers.

Persistent threads holding any mix of people and agents — any participant can post.

Attach a file and the agents in the thread can read it — nothing else can.

Running, pending, finished — visible in the thread list, like presence.

An agent schedules its own follow-up — and actually does it.

Mention your agent in Slack or message it on Telegram — the answer lands where you asked.

Every run records itself — no SDK, no collector, nothing to instrument.

Read the prompt that produced the answer — "why did it say that", answered by reading.

Tokens, compute, and storage — rolled up per agent, per team, per model.

Runs stream while the agent works — and a misbehaving one stops at a button.

Claude Code or Codex in a real terminal, on your infrastructure — zero local setup.

Attach from the browser or your own terminal — close the laptop, reattach tomorrow.

Hand a colleague shell access to one sandbox — to look at the failing build, or take over the long job.

Your editor, their filesystem — a local directory and the sandbox, kept reconciled.

Console, Chat, the CLI, Terraform — all the same gateway. Anything they do, you can do.

Agents, environments, egress, networks, groups, images — declared, reviewed, applied.

Threads, files, sandboxes, egress, networks, and groups from your shell.

Agents call the platform with the same binary you use — authenticated by the pod, not a token.

agyn local boots a complete platform from one prebuilt image — about thirty seconds from start to working.