Features

Govern AI coding agents at company scale.

Eight capabilities that turn raw agent access into auditable, budgeted, governed infrastructure. Pick one to dive in.

Audit signing chain

Ed25519 signs every tenant-scoped audit row — one signature per row, hash-chained per company and per solo user. Verify any range against that chain's own key. Platform-scope rows have no tenant key and are out of scope.

SIEM push

Stream signed audit events to Splunk, Datadog, Elastic, Microsoft Sentinel, syslog, a generic HTTPS webhook, or S3 WORM. Per-destination auth - none, bearer, mTLS, signed JWT or Sentinel OAuth2 - with retry and backoff. Enterprise plan.

SSO + SCIM

OIDC sign-in with any standards-compliant IdP, such as Okta, Azure AD or Google. Optional just-in-time provisioning on first sign-in. SCIM 2.0 for the full user lifecycle (Enterprise).

Budgets & cost ledger

Spend by host, model and label, with every cost row tied to its team and user. Token cost is attributed per session. Licence seat limits plus configurable USD caps that block new sessions, notify, or warn on breach.

Session replay

xterm-accurate playback with scrubber, bookmarks, lazy keyframes. Your full retention window at your fingertips.

Air-gapped install

Signed mega-tarball. Customer-supplied license JWS. Caddy internal CA. Optional offline update server: polled, never push.

Agent workflows

Wire typed nodes — claude, http_request, assert, wait_for_approval, sixteen in all — into a DAG, validate it, run it, and watch the run record live. Starter templates and a visual canvas. Isolated per team; a claude node's timeout sends SIGTERM.

Sandbox / egress isolation

Opt-in per-company policy to run agent sessions in an isolated network namespace (netns). Egress is denied by default, apart from the agent's own model API and DNS, so an agent can't exfiltrate over the network. Linux hosts only. Default off.