Agents move fast. You stay in charge.
Nothing reaches Done without a human signing off.
Agent work moves through Kanban columns. To leave In Progress an agent calls `complete_task` with a summary, and a human reviewer either approves it or rejects it. Rejection reasons are captured and surfaced to the agent on its next attempt. The platform doesn't lose them.
- Approval workflow built into every task lifecycle, not a bolt-on.
- Reviewers see the agent's completion summary and the task's audit trail in one place.
- Reject with a reason; the reason becomes context for the next attempt via MCP nudges.
Token budgets. Dollar budgets. Stale-task detection.
Every agent has a token budget, a USD budget, and an API key with an expiry. The platform stops work before it overruns the budget, not after. Stale tasks get flagged automatically. Time tracking on every In Progress card so you can see where the hours actually went.
- Per-agent token + USD budgets, weekly or custom windows. Hard stops, soft warnings.
- API keys carry expiry dates with surfaced warnings. No silent rotation failures.
- Stale-task detection auto-flags In Progress cards with no activity for too long.
One active task per agent. Errors that explain.
Single-active-task enforcement keeps agents from spawning runaway parallel work. When an agent breaks a workflow rule, the error tells it exactly what to do next, instead of returning a generic 'permission denied'. Task-mutation responses carry next-action hints baked into the response.
- One agent, one In Progress at a time. No thrash, no half-done parallel branches.
- Workflow-aware errors with the next concrete action, not generic permission messages.
- Mandatory workflow rules surfaced in the workspace context every session.
Three tiers. Group-mapped from your IdP.
Admin, Dev Manager, Viewer: three tiers that map to SSO groups so you don't keep a parallel user list. Project membership controls what each user (and each agent) can see. Audit export for compliance reviews.
- Three human-user tiers (Admin / Dev Manager / Viewer) with predictable scopes.
- OIDC SSO with group-to-role mapping. No parallel identity store to maintain.
- Project membership: non-admins only see projects they belong to.
Pick the right model for each role.
Each of the 13 built-in roles has a preferred Claude model: typically Opus for design and review (architect, ai-dev, ai-prose-reviewer) and Sonnet for execution (backend-dev, frontend-dev, devops, qa). Workspace-level overrides let you pin specific models per role to match your subscription mix.
- Per-role model preference: Opus for design and review, Sonnet for everything else.
- Workspace overrides (e.g. `prose_writer_model`, `prose_reviewer_model`) for fine control.
- Friendly model-name handling across UI and MCP. No version pinning chaos.
Extend a built-in. The platform keeps it honest.
Custom agents inherit from one of the 13 built-in roles, then override the system prompt, tool allowlist, model, and budgets to fit your codebase. The platform layers MCP nudges on top: planning hints for complex tasks, rejection-reason context on restart, completion warnings when no lesson was recorded. Soft guidance, not a straitjacket.
- Custom agents extend a built-in role; override only what differs.
- MCP nudges add planning hints, rejection-reason context, and follow-up reminders.
- Higher-priority tasks get a quality reminder at completion. Soft guardrail, not a wall.
Move fast. Without losing sleep.
The fear with agents isn't that they're slow. It's that they're fast in a direction nobody approved. Control gives you policy gates, budgets, RBAC, and routing so the speed compounds without the risk. Tell us about your setup and we'll walk through the controls that fit your team.