Where the rules get set.
Six ideas carry most of the platform. Learn them here and the rest follows — they are the same concepts whether you click them, script them, or declare them.
Environments
One definition names a runner, a compute flavor, the images a workload runs, and the volumes, tools, secrets, and egress rules that come with it. An agent runs in one. A sandbox runs the same one.
Which means what an engineer reproduces by hand is the thing that runs unattended — there is no gap left to be surprised by.
- runner
- prod-eu-1
- flavor
- ram-2gb
- workspace
- devcontainer-go : 1.2.0
- agent runtime
- codex : 0.146.0
- mcp servers
- files · postgres
- egress rules
- 4 attached
LLM gateway
Providers and models are configured once. Agents reference a platform model name, so moving a fleet to a newer version is one edit rather than a find and replace.
The workload calls a proxy that authenticates it and attaches the real key upstream. The container never holds a provider credential.
Egress
Rules match on domain, path, method, and port, and either allow a destination or deny it. Anything unmatched is denied.
Credentials for allowed destinations are attached at the network edge, after the request has left the container. A token the agent cannot read is a token prompt injection cannot steal.
Private networking
A private resource maps a hostname the agent dials to a host inside your network, reached through a tunneler you run. Access is granted per principal — an agent, a person, an app, or a group.
No bastion, no VPN, and no flattening of your network to make it work.
Identity & access
People, agents, apps, and runners are all identities with a platform ID. Groups sync from your identity provider, so the access review your security team already runs covers agents too.
Permissions are derived from relationships, which makes “who can talk to the finance agent” a query with an answer rather than a spreadsheet somebody maintains.
| Identity | Can be granted |
|---|---|
| user | agent roles · private resources · groups |
| agent | egress rules · private resources · other agents |
| app | conversations · private resources |
| runner | which environments may place work on it |
Images & runners
Register the images your organization may run, in three slots. Environments choose from that catalog rather than from arbitrary registry references.
So the set of things anyone in the company can run is a list somebody approved. Runners decide where the work lands.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.