AI agents for real business work
Build AI agents that can actually work.
Give agents access to the right tools and business context, define what they can do, and deploy them to work safely across your company.
No code for business teams. Full APIs and SDKs for developers.
What changes
A prompt answers once. An agent owns a job.
The distinction is everything after the answer. One of these leaves the work with you; the other does it every morning and tells you what it decided.
What should your agent do?
Every weekday, check overdue invoices. Email customers 7–21 days overdue. If an invoice is more than 30 days overdue, ask Finance before contacting the customer.
Accounts Receivable Agent
Not deployedGoal
Follow up overdue invoices
Trigger
Weekdays at 08:00
Can read
CustomersInvoicesPayment status
Can do
Send payment remindersCreate follow-up tasks
Must ask a human
Invoices more than 30 days overdue
Accountable owner
Finance Manager
A prompt
Which invoices are overdue?
17.
Correct, instant, and the work is still entirely yours.
An agent
- 1Checks every weekday morning
- 2Finds the invoices that are overdue
- 3Looks up each customer's context
- 4Sends the reminders it is allowed to send
- 5Escalates the exceptions to Finance
- 6Records what happened, and why
The same question, answered every morning without being asked — and then acted on.
The problem
An AI agent should not have unlimited access to your company.
There are two ways to give a model the ability to act. The first is four steps and is what most of this category currently does.
The shortcut
An API key with full access, pasted into a prompt.
- Nobody can tell which agent acted, or whether it was an agent at all.
- There is no capability it cannot reach, so there is nothing to review.
- Revoking it breaks every other thing using the same key.
- The audit log records the key, not the decision.
How this works instead
Eight steps, and the agent cannot skip one. Each is a place you can look, change or revoke.
- 1Agent
- 2Identity
- 3Permissions
- 4Approved tools
- 5Policy
- 6Human approval where required
- 7Action
- 8Audit trail
Give agents tools. Not your keys.
Every capability is explicitly exposed, permissioned and monitored. Agents only see and do what you have allowed — and the things that move money or change access are refused to every agent on every plan, rather than offered as a setting.
How it works
Build. Connect. Permit. Deploy. Observe.
Five phases, and the same five in the application's own navigation — so the shape you learn here is the shape you find after signing in.
Build
Describe the job. Review what it becomes.
Connect
Give it capabilities, not credentials.
Permit
Allow, approve or never. Default never.
Deploy
It runs, inside its limits.
Observe
See what it did, and why.
Agent templates
Start with a job that already exists.
10 jobs most businesses already do by hand, each arriving with a trigger, a read list, an action list, a boundary list and an escalation rule.
Sales Follow-up Agent
Makes sure every new lead is followed up, every time.
SalesOwned by the Sales ManagerAccounts Receivable Agent
Chases overdue invoices, and knows when to stop and ask.
FinanceOwned by the Finance ManagerCustomer Support Agent
Answers the routine questions and escalates the rest.
ServiceOwned by the Service LeadCustomer Success Agent
Finds the accounts that need attention before they leave.
ServiceOwned by the Service LeadCampaign Agent
Watches campaign performance and asks before it spends.
MarketingOwned by the Marketing LeadExecutive Briefing Agent
Summarises what needs a decision today.
OperationsOwned by the Operations ManagerBusiness context
Your business becomes the agent's toolbox.
Customers, finance, email, service, content, website, analytics, people. Each connected system contributes a set of narrow capabilities — and contributes nothing else.
Connecting is not granting
A connected system makes capabilities available to grant. It grants nothing. Every agent is still given each capability individually, and most hold three or four.
“Read an invoice”, not “query the ledger”
A capability whose risk depends on what the agent decides to ask for cannot be reviewed. So the narrow version is the only version.
The agent never holds a credential
It calls a capability by name and the platform makes the call with its identity attached. Nothing is in the agent's context to leak.
Your business becomes the toolbox
Nothing on this diagram reaches the agent directly.
Your systems
Accounts Receivable Agent
Holds four capabilities. Has no login to any system above.
Human control
AI that knows when to ask.
An agent that reaches the edge of its authority prepares the action, gathers the evidence and asks a named person. It does not proceed, and it does not quietly do nothing.
A customer asks for 20% off. The agent may approve up to 10%. So the Sales Manager gets a request with the competitor quote attached, and three answers: approve once, refuse, or change the rule so the agent stops asking.
The third answer is the one most products leave out, and the only one that makes an approval queue shrink instead of grow.
Discount above the standard limit
Sales Follow-up Agent · waiting 12 minutes
Customer
Harbourview Hotel
Beyond its authority
Standard limit 10%. The agent is asking for 18%.
Why it is asking
A competitor quote was attached to the buyer's last email.
What it would do
Send a revised proposal at 18%
Who decides
Sales Manager
Runtime
Built to keep working.
Agents run on demand, on a schedule, on an event or continuously — each isolated, with its own resource limits, its own secrets and its own network boundary.
Deploy once
The infrastructure required to keep an agent running reliably is ours to worry about. Retries, backoff, timeouts and durable state sit in the runtime rather than in every agent's logic.
An interrupted agent does not start over
One that was cut off after sending six of eleven reminders resumes at the seventh. Duplicates are the failure your customers actually notice.
It degrades in a defined order
If the reporting layer fails, agents keep running. If the model layer fails, they stop cleanly rather than acting on incomplete information.
In control
Nobody deploys something they cannot switch off.
Stopping does not undo what already happened — a sent email is sent. The platform records exactly what completed before the stop, so you know what to unwind.
Observability
See exactly what every agent did.
Every run produces a timeline: what triggered it, what it read, what it decided, what it did, what it asked about and what it cost. Written for the manager who owns the agent, not only for the developer who built it.
This morning’s run
Accounts Receivable Agent v1.4 · Schedule — weekdays at 08:00 · 7 minutes · €0.42
- 08:00
Triggered by schedule. Identity agent:accounts-receivable, version v1.4.
- 08:01
Read 214 open invoices from the finance ledger. 42 are overdue.
- 08:02
Selected 11 inside the 7–21 day reminder window.
- 08:03
Retrieved customer context for all 11 — balance, terms, open disputes.
- 08:04
Excluded 3 invoices more than 30 days overdue. Policy requires Finance to decide.
- 08:05
Sent 8 payment reminders from the company mailbox.
- 08:06
Requested 3 approvals from the Finance Manager.
- 08:07
Completed. 8 actions taken, 3 awaiting a human, 203 invoices needed nothing.
214 invoices checked this morning. Three need you.
203 + 8 + 3 = 214. The Finance Manager opened three items, not two hundred.
Today
Every entry names the agent that acted.
Agents handle the routine. Humans handle the exceptions.
214 invoices checked this morning. Three need a decision. The point of an agent is to reduce work, not to produce another dashboard to check — so if nothing needs you, the platform says so and stops.
Your agents
One page for everything acting on your behalf.
Every agent, its team, its owner, whether it is working and when it last acted — ordered by what needs attention rather than by what is busiest.
Eight agents working, one paused. The paused one found two product descriptions that disagree on lead time, and stopped rather than choosing between them.
That is the product working correctly. An agent that resolves a contradiction by picking a side has invented a company policy.
Kestrel Supply Co
Your agents today
Working
8
Tasks done
142
Need you
4
Needs attention
1
Stopped after finding two product descriptions that disagree on lead time. It will not choose between them.
Developers
Build agents your way.
Use our runtime, tool registry and security layer — and keep complete control over your agent logic. No graph to conform to, no chain abstraction, no framework to adopt. Python and TypeScript SDKs, a full HTTP API, a CLI, declarative manifests reviewable in a pull request, and evaluation suites that run in your pipeline.
Your logic, our identity, permissions, secrets and audit
Expose your own service as a permissioned capability
Manifests in source control — access changes show in the diff
A sandbox with synthetic data and no route to production
Evaluation suites that block a deploy when a refusal regresses
One-command rollback, permissions included
Marketplace
Install a capability your company does not have yet.
Agents built by us, by verified partners and by independent developers. An agent is not a plugin — it is something that will act on your behalf — so every listing states its publisher, its tier and every capability it requests, before anything is deployed.
Security
Agents need more than prompts. They need boundaries.
Anything enforced only in a prompt is a request, and anybody who can send your company a message can try to change it. So the controls sit outside the model.
By team
The first job is different in every department.
Finance reaches for invoice chasing; sales reaches for the twenty leads a week nobody replied to. Same platform, different first candidate.
How is this different from a chatbot builder?
A chatbot answers. An agent owns a job. The difference is everything after the answer: an identity of its own, capabilities it was granted rather than credentials it holds, limits on what it may decide, a human it asks when it reaches the edge of its authority, a runtime that keeps it working, and a record of everything it did. A chatbot that could email your customers about their invoices would need all of that too — which is roughly the point.
Do I need a developer?
No. A business user describes a job in plain words and the studio builds the agent, and every capability, boundary and approval rule is shown in words before it is deployed. Developers get SDKs, an API, a CLI and manifests for agents that need real logic. Both produce the same kind of agent with the same permissions and the same audit trail — there is no weaker path.
What stops an agent doing something we never intended?
Four things, in order. It has no capability it was not granted. Capabilities that move money or change access are refused to every agent on every plan, not offered as settings. Actions beyond its authority — a discount above your limit — become requests to a named person. And its network reach is a list rather than the internet, so it has no route to send your data anywhere nobody approved. None of that depends on instructing the model carefully, because an instruction is a request rather than a limit.
How do we stop an agent if something goes wrong?
Any agent can be paused or stopped immediately, mid-run, and one control halts every agent in the workspace. Any agent owner can stop their own; administrators can stop anything. Stopping does not undo what already happened — an email that has been sent is sent — so the platform records exactly what completed before the stop. That is also why boundaries and budgets exist: the emergency stop is the last control, not the first.
What does it actually cost to run an agent?
A plan, plus what your agents consume in model usage and runtime. The product estimates an agent's monthly cost before you deploy it — runs, model, runtime and a total — and shows the actual against that estimate afterwards. A light agent such as a morning briefing runs at around €11 a month; a busy finance agent doing over a thousand decisions runs at around €74. If an agent costs materially more than its estimate, that is a bug in the estimate and we would rather you saw it at the review screen.
Will our data be used to train models?
No. Your agents' work, your customer records and your approved knowledge are not used to train models made available outside your account. That is a contractual commitment rather than a setting, and the same prohibition applies to the model providers we use. Content in categories you mark sensitive is excluded from model requests by default.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]