Security, enterprise and cost, in brief

Security, in brief

Security here is the architecture, not a feature list. Identity is real: machines join by certificate — the device key is minted on the machine and never moves, admission is an explicit owner act, host keys are pinned at admission rather than trusted on first contact — and the control plane connects outward only; a runner holds no credential to it and no inbound port is required by the product. Runs are bounded: seats keep agent profiles apart; execution is confined with deny-by-default writes at the OS level — on the control plane's own machine and, for runs dispatched over SSH, by the runner's own kernel against a capability the engine measured on that machine — with kernel-level read-deny on lane credentials; secrets are configured by variable name or path, never by value, anywhere. Decisions are provable: gate rows are signed and re-verified at merge, and a third party holding only the root public key can verify the fleet's governance history without trusting the machine that produced it. Fail-closed is the house style — an unrecognized setting, a missing sandbox, an ambiguous bind address each refuse with a named class instead of degrading quietly — and refusals are data, ledgered with rule and reason. The document is equally candid about limits: no vendor can promise an unpersuadable model, so the posture is to bound what a persuaded agent can reach and to keep what it did — and what was refused — on the record. The full model, defaults, worked ceremonies and the documented limits: Security.

Enterprise, in brief

For an enterprise the question is not which model writes the best code; it is attribution, authority, separation of duties, cost governance and incident answerability. Saphan makes those structural: no code path in the product can accept, merge or promote — a gate decision is a human act with no default value, no timeout-as-consent, and a closed decision vocabulary; implementer, reviewer and approver are distinct roles with tooling-enforced footprints; suggestion and decision are separate recorded events, so the trail shows what was recommended, by whom, and what the human actually decided. Actors have no lateral channels — no agent-to-agent side traffic exists in the product; every coordination surface is a recorded one, so "who told whom what, when" is a query, not an interview. Because the record is the architecture, the evidence regulated organizations are asked for falls out of normal operation — the enterprise document maps it clause-by-clause to ISO/IEC 42001 and 27001, SOC 2, NIST AI RMF and the EU AI Act, and is explicit that standards certify your management system, not a vendor's product. Deployment follows one doctrine: your machines, your record — a PostgreSQL record store on infrastructure you control, management surface on loopback by default, and for hosted conveniences identity passes; data never. Where a control does not yet enforce, the roadmap names it instead of claiming it. The posture, the evidence catalogue and the regulatory mapping: Enterprise.

Cost, in brief

Agent development has a real price per unit of work, and in most organizations nobody can name it. Saphan makes cost a first-class, governed dimension: every run is quoted and capped before it starts — the dispatch composer refuses to compose without a cost estimate, and the cap is derived from the quote by one stated rule — and every run's actual lands in the ledger next to its quote, tagged with stream, repo, actor, role, model and backend. So spend is answerable per workstream, per merged change, per person, per model — and because the same record holds gates and costs, spend is attributable to decisions: not "we spent $412 on agents in July" but "this merged change cost $9.80 against an $11 quote, approved by this person at this gate." Work routes down a cost ladder — deterministic tools at zero, local models at electricity, subscription seats at flat rate, metered frontier where judgment demands it — with the model an explicit, stated decision per class of task, refusals booked as near-zero rows, and failures classified by named status, never shrugged at. And the biggest lever is not the price list: a defect caught in the order costs a re-read; the same defect caught in implementation costs an executor run, a review round and a re-dispatch — the planning discipline of section 6 is the cost control. The ledger anatomy, the model-per-task economics, the calibration register, the pass-class honesty metric and worked examples: Cost management.