Security, enterprise and cost, in brief

Security, in brief

Security here is the architecture, not a feature list. Identity is real: machines join by certificate — the device key is minted on the machine and never moves, admission is an explicit owner act, host keys are pinned at admission rather than trusted on first contact — and the control plane connects outward only; a runner holds no credential to it and no inbound port is required by the product. Runs are bounded: seats keep agent profiles apart; execution is confined with deny-by-default writes at the OS level — on the control plane's own machine and, for runs dispatched over SSH, by the runner's own kernel against a capability the engine measured on that machine — with a named deny list (signing keys, seat tokens) hidden from reads; ⚠ not every backend is confined by the engine on every platform, and where it is not the run record says so (sandbox matrix); network egress is closed by default and opened only per run, with a recorded reason (egress control); secrets are configured by variable name or path, never by value, anywhere. Decisions are provable: gate rows are sealed with the workspace key and re-verified at merge — tamper-evident, though not proof of which key holder wrote them — and a third party holding only the root public key can verify the signed governance log without trusting the machine that produced it (the record). Fail-closed is the house style — an unrecognized setting, a missing sandbox, an ambiguous bind address each refuse with a named class instead of degrading quietly — and refusals are data, ledgered with rule and reason. The document is equally candid about limits: no vendor can promise an unpersuadable model, so the posture is to bound what a persuaded agent can reach and to keep what it did — and what was refused — on the record. The full model, defaults, worked ceremonies and the documented limits: Security.

Enterprise, in brief

For an enterprise the question is not which model writes the best code; it is attribution, authority, separation of duties, cost governance and incident answerability. Saphan Studio makes those structural: no code path in the product can accept, merge or promote — a gate decision is a human act with no default value, no timeout-as-consent, and a closed decision vocabulary; implementer, reviewer and approver are distinct roles with tooling-enforced footprints; suggestion and decision are separate recorded events, so the trail shows what was recommended, by whom, and what the human actually decided. Actors have no lateral channels — the product provides no agent-to-agent channel outside the record; every coordination surface it offers is a recorded one, so "who told whom what, when" is a query, not an interview. Because the record is the architecture, the evidence regulated organizations are asked for falls out of normal operation — and standards certify your management system, not a vendor's product. Deployment follows one doctrine: your machines, your record — a record store on infrastructure you control (SQLite by default; PostgreSQL for a central deployment), management surface on loopback by default, and for hosted conveniences identity passes; data never. ⚠ The PostgreSQL store is built but its schema has not been exercised against a live server; treat it as unproven. Where a control does not yet enforce, the page that owns it says so instead of claiming it. The deployment postures: Deployment; the questions each framework asks and the artefact that answers them: Audit and compliance.

Cost, in brief

Agent development has a real price per unit of work, and in most organizations nobody can name it. Saphan Studio makes cost a first-class, governed dimension: every run is quoted and capped before it starts — the dispatch composer refuses to compose without a cost estimate, and the cap is derived from the quote by one stated rule — and every run's actual lands in the ledger next to its quote, tagged with stream, actor, role, model and backend. ⚠ The ceiling is enforced at a dollar figure only on the claude-code backend; on the others it is recorded, and the run's wall-clock ceiling is what stops it. So spend is answerable per workstream, per merged change, per person, per model — and because the same record holds gates and costs, spend is attributable to decisions: not "we spent $412 on agents in July" but "this merged change cost $9.80 against an $11 quote, approved by this person at this gate." Work routes down a cost ladder — deterministic tools at zero, local models at electricity, subscription seats at flat rate, metered frontier where judgment demands it — with the model an explicit, stated decision per class of task, refusals booked as zero-cost rows, and failures classified by named status, never shrugged at. And the biggest lever is not the price list: a defect caught in the order costs a re-read; the same defect caught in implementation costs an executor run, a review round and a re-dispatch — the planning discipline (cheap by planning) is the cost control. The ledger anatomy, the model-per-task economics and worked examples: Cost management.