Agents that earn production.
An agent that cannot be evaluated cannot be trusted. Every change ships through review, every version is gated by an evaluation baseline that can only rise, and every tool call passes a declared policy.
Catalog as code
From pull request to production
78% of investment managers are piloting agentic AI; 27% report significant impact. The gap is rarely the model — it is missing governance. This is the production scaffolding, shipped as first-class infrastructure.
Declare
An agent, tool, skill or environment is added or changed as a versioned file in the Git catalog — never configured ad hoc in a console.
Review
A pull request is the only door. Reviewers see the full diff of behavior; an allow on a sensitive tool requires a written rationale, enforced by CI.
Evaluate
CI re-runs the agent's versioned eval dataset and compares the score against its baseline. Regressions are flagged on the PR — advisory in Beta, blocking at GA.
Run
Merged descriptors become callable. Every run records the catalog SHA it executed, so any output traces back to the exact reviewed version.
Evals & baselines
Quality is a gate, not a hope
Every agent carries a versioned evaluation dataset and a committed baseline score. CI re-runs the evals on every change to the agent, its skills or its bundles.
Versioned eval datasets
ShippedEvery agent ships with a Git-versioned evaluation dataset that lives next to its descriptor and evolves under the same review process.
Baselines that only rise
ShippedEach agent version commits a baseline score (0–1) that may only be raised. Quality is a ratchet, not a hope.
Fleet-wide re-runs
ShippedChanging a shared skill or tool bundle re-triggers evals on every agent that declares it — one improvement cannot silently degrade another agent.
Blocking gates
GA Q3 2026Today the eval gate is advisory: regressions are flagged for reviewers. At GA the gate becomes blocking — a regression stops the merge.
Tool policies
allow / ask / deny — on every tool call
Policies are declared per tool inside each agent's descriptor, reviewed with it, and enforced by the runtime. Sensitive actions are paused or blocked by default, not by exception.
The tool executes directly. An allow on a tool with side effects requires a written rationale in the descriptor — checked by CI, visible to reviewers and auditors.
The run pauses mid-flight for explicit human approval — an inline card in chat, an API response in task mode. Decisions are recorded with who, when and why. Ships in Beta.
The tool is declared and visible but blocked at runtime. Deny keeps intent auditable: reviewers see what the agent could ask for and what it will never get.
Honest status: the V0 runtime enforces allow-only execution and refuses everything else. The ask pause flow ships with the Beta — we do not demo it as live.
# excerpt — tool policies in an agent descriptor
tools:
- name: platform.dh.search_rules
policy: allow # read-only, executes directly
- name: platform.dh.update_rule
policy: ask # pauses for human approval (Beta)
rationale: writes to the Business Rule engine
- name: external.jira.create_issue
policy: deny # declared, visible, blockedHuman-in-the-loop
Humans control sensitive actions
Agents do the digging; your people decide. Human-in-the-loop approvals turn that principle into a runtime mechanism.
The pause
BetaAn ask policy stops the run before the sensitive action executes. In chat the user sees an approval card inline; in task mode the calling workflow receives a structured approval request. Default timeout: 30 minutes.
The decision
BetaApprove or deny, with context: the tool, its inputs, the agent's reasoning so far. Either way the run resumes deterministically — approval is part of the run, not a side conversation.
The record
ShippedWho approved, when, what and why become first-class entries in the append-only audit log — the same log that already records every run, designed for 7-year retention.
FAQ
Frequently asked questions
Are eval gates blocking today?
Not yet, and we say so. CI re-runs every agent's eval dataset on every change and flags regressions on the pull request — advisory during Beta, blocking at GA in Q3 2026. The baseline score itself can only be raised, at every stage.
What happens when a change lowers an agent's eval score?
The CI eval run compares the new score against the agent's committed baseline and flags the regression on the pull request, so reviewers decide with the evidence in front of them. At GA, the same comparison blocks the merge outright.
How do allow, ask and deny policies work?
Each tool in an agent's descriptor carries a policy: allow executes, ask pauses the run for an explicit human approval, deny blocks. Irreversible side effects default to ask or deny, and an allow on a sensitive tool requires a written rationale enforced by CI. The V0 runtime executes allow tools only and refuses anything else; the ask pause flow ships in Beta.
Who approves a paused run, and is the decision recorded?
Human-in-the-loop approvals are a Beta capability: when an ask policy triggers, the run pauses and a human approves or denies — an inline card in chat, an API response in task mode, with a 30-minute default timeout. Every decision — who, when, what, why — is a first-class entry in the append-only audit log.
Can anything run outside this process?
No. The catalog-first integrity contract means nothing undeclared is callable, injectable or provisionable. There is no side channel: the Console is a view over the same API, and every UI action shows its curl equivalent.
Keep exploring
More of the platform
- Platform overviewThe governed agentic platform, end to end.
- Agents & catalogDeclared, versioned agents — descriptors, skills, modes.
- Security & trustIdentity, tenant isolation, vaults, append-only audit.
- DeploymentEU SaaS today; hybrid, on-prem and sovereign at GA.
- Integrations & MCPMCP tools, NeoXam products, open standards, models.
- Observability & costOpenTelemetry traces, budgets, cost per run and tenant.
- ArchitectureRunner, harness, control plane vs execution plane.
General availability comes in Q3 2026. The Early Adopter Program is open now.
A limited cohort, a one-year platform trial and three workshop streams — Business ROI, Compliance, Operational fit. Bring one workflow; leave with a governed agent and the evidence to certify it.