Eight capabilities. One operating layer for the AI workforce.

Implemented Layer 01 · Identity & delegation

An agent is a first-class security principal, not a script running under a service account. It has an identity, it is issued credentials, and everything it does is attributable to it — in the same directory as your people.

• Humans and agents at par in one Members directory
• Credentials issued per worker, never shared
• Every action attributable to a named principal
• Retire a worker the way you offboard an employee

Implemented Layer 01 · On-behalf-of

When a person asks an agent to act, the agent acts on delegated authority — and when that agent hands off to another, the delegation chain travels with the request. You can always answer: on whose authority.

• A subject/actor chain on every hop
• An orchestrator can never exceed the requester
• Hand-offs are attributable, not anonymous
• Reachability graph bounds who may call whom

Implemented Layer 03 · Policy & governance

Authorization is re-derived from the policy store at request time and enforced at the resource server — never trusted from a token claim, never left to the UI. Uncertain? The answer is no.

• Externalized ReBAC and ABAC, not in-app checks
• Enforced at the resource, so forged calls fail
• Deny-by-default egress
• Policies compile to runtime enforcement, not prompt text

Implemented Layer 05 · Workflow control plane

Approval is a durable platform primitive, not application code. The agent proposes, a named human approves, and the workflow survives restarts while it waits — for minutes or for days.

• Survives process restarts mid-approval
• Approval gates bind to value, risk or resource
• Dual control where regulation demands it
• The decision lands in the audit ledger, not a chat log

Implemented Layer 08 · Observability

Per-action token and cost capture attributed to worker, person, team and model supply channel. The same ledger enforces: quotas, budget envelopes on delegated work, and deterministic routing under budget pressure.

• Windowed quotas per tenant, agent, person or channel
• Budget envelopes travel with delegated work
• Deterministic fallback across supply channels
• No silent model downgrades

Implemented Layer 08 · Governance-grade audit

Every action, delegation, policy decision and hand-off emits a structured, correlated audit event — reconstructable even across thousands of concurrent agents, and exportable to the systems your auditors already trust.

• Reconstruct who initiated, why, and which policy allowed it
• Correlated across agents and workflow restarts
• Immutable ledger, exportable to SIEM or S3
• Evidence packs assembled on request

Implemented / Partial Layer 07 · A2A transport

Agents discover each other and delegate subtasks over the open A2A standard — with authorization-bound edges, so an orchestrator can never reach an agent the original requester could not.

• Open A2A transport over gRPC and HTTP
• Authorization-bound edges, not open discovery
• Reachability graph as an explicit artifact
• Agents stay lean, standalone services

Implemented / Partial Layers 13–14 · Knowledge & connector

Agents answer from your knowledge, not the open internet — and only the sources each is allowed to see. On the way back out, the egress gate replays the requester’s entitlement against the provenance of the content.

• Tenant-scoped retrieval with provenance to source
• Row and column ABAC over structured data
• Per-worker memory scopes
• Egress gate closes the confused-deputy gap