This is the half of the work platform teams ask for by name. It is also the crowded half of the market, and we are direct about that: we enter here because it is what you need first, and we differentiate on assurance and context because that is what nobody else sells you.
Not as a trusted coworker. Not as a deployment. An agent is a non-deterministic process that assembles its own context, chooses its own path, and — under permissive conditions — has been observed finding routes nobody designed. That is not a moral claim about the model. It is the only threat model that produces controls which hold.
Fraud practice already treats identity as continuous risk evaluation across login, account change, money movement, and support channels. Agents deserve the same treatment: re-evaluate per action, not per session.
Per-agent, per-task workload identity with short-lived credentials. No shared service principals. No standing production write access. If a scope is permanent, it is a standing risk with a friendly name.
Money, access grants, data egress, regulated decisions, destructive operations. The approval matrix is written down, versioned, and reviewed — not encoded in whoever happens to be on call.
Ephemeral, isolated, fast-to-provision environments that agents can create, break, and destroy. Provisioning time is a first-class metric, not an inconvenience: an agent that waits 25 minutes for an environment cannot iterate, and an agent that cannot iterate is a very expensive autocomplete.
Realistic data without exposing production data is a data engineering deliverable, not a platform one. Masking, subsetting, referential integrity across the subset, and classification-aware redaction are pipeline work.
We have watched this be the actual blocker often enough that we assess it in the entry baseline before anyone signs up to build a runtime on top of it.
The permissioned catalogue of everything agents may do to internal systems — deploy, scale, run a migration, refresh a dataset, open a change request, page a human. If your agents currently reach systems through ad-hoc scripts and a shared token, this is the single highest-value thing you can fix.
| Every tool contract carries | Why it exists |
|---|---|
| A version | Tools change. An agent that learned an older signature must fail loudly rather than guess. |
| Typed input and output | Structured I/O is the difference between a checkable result and a paragraph of confident prose. |
| Idempotency semantics | Retries are normal in agentic systems. A tool that is not explicit about repeat-safety will eventually be called twice. |
| Scoped workload identity | The tool, not the agent, holds the permission — bound to the task, expiring on completion. |
| A prohibited-operation register | Named things this tool must never do, enforced at the gateway rather than requested in a prompt. |
| Dry-run mode | Every destructive tool can show its intended effect before taking it. Reviewed before first live use. |
| Trace correlation | One identifier links the request, the reasoning, the tool call, the audit record, and the outcome-ledger entry. |
| An immutable audit record | For every write. Audit that an agent can edit is decoration. |
What we do not do: rebuild your developer portal. If you run Backstage or an equivalent, we ingest from it and write back to it. We own the agent-facing projection of your estate, not the human-facing one. Replacing a portal your developers already tolerate is a two-year distraction from the actual problem.
— Anti-pattern we refuse on principleHuman approval is mandatory for money, access grants, data egress, regulated decisions, and destructive actions. Each row names the action class, the approver role, the evidence the approver is shown, and the timeout behaviour — because an approval request that silently expires into “proceed” is worse than no approval at all.
Acceptance evidence for this block is not “approvals work”. It is a recorded instance of an unsafe action being correctly refused.
The failure that upgraded this from “kill switch” to “lifecycle control”: an operator stopped a public-facing agent, its launch daemon restarted it, and by morning it had answered roughly 800 messages while users probed it. Safety language in a prompt is not a control. Neither is a stop button that a supervisor overrides.
Demonstrated live, not asserted in a document. We disable an agent, attempt a restart through every path that exists in your estate — supervisor, scheduler, deploy pipeline, manual — and confirm the disablement holds for a full cycle.
Then we write down what it took, so the next operator can do it at 3am without us.
In the entry baseline this runs read-only against a non-production agent. It is frequently the moment a client stops treating this as a theoretical exercise.
This work is designed for platform and internal-developer-platform teams that already own cloud governance, CI/CD, and a container or app platform. That is not a snobbery filter; it is a load-bearing assumption. A tool plane, an environment fabric, and lifecycle control all need somewhere to be installed.
We will tell you in the first conversation, and we will not sell you an agent runtime to install on top of nothing. The honest sequence is platform first, then agents on it. That is real work we know how to do — landing zones, IaC, golden paths, observability, cost guardrails, recovery — but it is a different engagement with a different shape and we will scope it as one.
Selling rung 2 to an estate at rung minus-one is how consultancies produce expensive disappointment.
We are honest that our deepest delivery experience is Azure-leaning while this buyer is frequently Kubernetes-first and multi-cloud. The controls, contracts, and evidence model are portable; the shortcuts are not. Ask us directly what we have run at depth and what we would be learning on your time — we will answer specifically.
The entry baseline inventories it, tests whether your controls hold, and gives you a ranked gap report with a costed plan. Read-only first, so it clears security review without a fight.