Outcomes · For engineering teams

Agents safe to put into production

Every tool call your agent makes is checked against permissions before it runs, and the actions that matter wait for a person.

Who it is for

Who this is for

Engineering and platform teams connecting agents to real systems, and the security reviewers who have to sign that off.

What changes

Access rules live in the prompt, and prompts alone cannot enforce them.
The agent holds the credential, so nothing stands between a bad tool call and the system it targets.
After an incident, nobody can show who asked for an action or which rule allowed it.

Each tool request is checked outside the agent: allowed, blocked or held for a reviewer.
If a held request changes, such as a different amount or target, it needs a new approval.
Who requested each action, which rule applied and what happened next is recorded.

How it is delivered

Delivered by Remus, which controls what an agent may do, and by Ithaca, which is being built to give it an isolated place to run.

Remus: tool credentials stay with the service that checks permissions, so an agent cannot bypass the check with its own credential.
Remus: requests carry both the agent and the user it acts for, and an action must fit both sets of permissions.
Ithaca: planned isolated Linux environments, with approval checks at protected tool boundaries.

What you provide

Node.js 24 to run the Remus preview.
A list of every system and credential the agent needs.
Which actions may run automatically and which require review, and who reviews them.

How the result is measured

Run the Remus quickstart: it asserts an allowed read, a blocked deletion, an approval-gated refund and a retry that does not repeat it.
For your own workload, test allowed actions, denials, expired approvals and attempts to reach the tool directly.

How to start

Remus runs on your machine today. Ithaca is not available yet; its page ends in a waitlist.

Good to know

Remus is a local, single-principal developer preview. It does not provide hosted access, production authentication or a policy editor.
Remus is not yet integrated with an Ithaca compute service. An integrated stack is the direction, not something available today.
Ithaca's proposed design checks protected actions at trusted tool boundaries. It does not claim to intercept every shell command.
No security certification is claimed for either product.

For engineering teams