Autonomous, on a leash
The agent that closes your backlog while you sleep.
It reads the issue, writes the branch, opens the pull request, and stops at the merge button. You approve the three decisions that matter and skip the forty that do not.
Trusted by the people who had to approve it
No card. Every action logged. Revoke a tool and the next run respects it.
Running in production at
- Northgate
- Basalt
- Quorum Labs
- Ferrite
- Meridian
- Hollowpoint
How it works
It runs a loop, and it stops before the parts you care about.
Every run is the same shape. The interesting part is not that it is autonomous — it is where the autonomy ends.
01
Scoped at the call site
Permissions are enforced where the tool is invoked, not asked for politely in a system prompt. A revoked tool is gone on the next run, mid-task included.
02
Every run leaves a trace
Each step records the tool, the arguments, the result and the elapsed time. When something goes wrong you get a transcript, not a shrug.
03
Priced by work, not by seat
You pay for completed runs. A run that stalls, loops, or gets rejected at handoff does not bill.
Permissions
Everything it can reach, and everything it has to ask about first.
Scoped per tool, enforced at the call site rather than in the prompt. The blanks below are real: where there is no cell, there is no access.
| Tool | Reads | Writes | Needs approval | Audited |
|---|---|---|---|---|
| GitHub | repos, issues, pull requests | comments, branches | Waits for approval on: merge, force-push | audited |
| Slack | channels it is invited to | messages in those channels | no access | audited |
| Postgres | analytics.* (read replica) | no access | no access | audited |
| no access | send as agent@yourdomain | Waits for approval on: any external recipient | audited | |
| Filesystem | /workspace | /workspace | Waits for approval on: delete, chmod | audited |
| Shell | no access | no access | Waits for approval on: every command | audited |
Rows come from src/content/tools/tools.yaml. Leave a field empty and the cell stays empty — that is the honest version, and it is the one that gets believed.
And this is the whole of it.
One definition per tool. The four fields in the table above are the four fields here — there is no second place where permissions are configured, and no prompt that can widen them at runtime.
Delete a line and the capability is gone on the next run, mid-task included.
import { defineTool } from '@astroloop/sdk'
export const github = defineTool({
name: 'github',
reads: ['repos', 'issues', 'pulls'],
writes: ['comments', 'branches'],
// Anything listed here stops the run and waits for a person.
// Checked at the call site, so the agent cannot talk its way
// past it the way it can with an instruction in the prompt.
approval: ['merge', 'force-push'],
audit: true,
})In production
1.24M
runs completed
last 30 days
3.1%
escalated to a person
and none of them silently
0
unapproved merges
since the check moved out of the prompt
11s
median time to first tool call
p95 is 34s
What people say
The people who had to sign off on it.
I approved it for a two-week trial expecting to revoke it. What changed my mind was not the output, it was that every refusal showed up in the log with the reason attached.
Priya Raghunathan
Staff Security Engineer, Basalt
It closed forty-one issues in its first month and asked me eleven questions. The eleven were the right eleven, which is the part I did not expect.
Tom Íñigo
Engineering Manager, Northgate
We had already written the policy doc for what an agent would be allowed to do. Configuring it here took an afternoon because the fields were the same fields.
Wen Xiaoqing
Platform Lead, Quorum Labs
Pricing
You pay for work finished, not for people logged in.
A run that stalls, loops, or gets rejected at handoff does not bill.
Free
$0forever
20 runs a month
- All tools, same permissions
- Full run transcripts
- Community support
Team
Most teams$29per month
then $0.40 per run
- Unlimited approvers
- 90-day transcript retention
- Slack and email handoff
- Priority queue
Enterprise
Talk to us
volume pricing
- Self-hosted runners
- SSO and audit export
- Custom tool allowlists
- A person who answers
Questions
The ones we get asked before the trial, not after.
- What counts as a run?
- One goal, from the first plan to either a result or a rejected handoff. Retries inside a run are not billed separately.
- Can it act without asking?
- Only for actions you have not listed under approval. Everything on that list suspends the run and waits, and the list is enforced in the tool layer rather than the prompt.
- What happens when it stalls?
- The run is cancelled at the step budget and not billed. You get the transcript either way.
- Where does my code go?
- Into the runner for the length of the run, and nowhere else. Self-hosted runners are available if that is still one place too many.
- Which models does it use?
- Whichever you configure, including your own keys. The permission layer does not change with the model.
- Can I revoke a tool mid-task?
- Yes. Permissions are read at the call site, so the next call fails closed even in the middle of a run.
Writing
What we got wrong, in public.
Why approval cannot live in the prompt
An instruction that says "always ask before merging" is a suggestion. Here is where we moved the check, and what it cost us to move it.
What a run actually costs
We billed per seat for two months. Here is why we stopped, and what the numbers looked like on both sides of the change.
The transcript is the product
We built the run transcript as a debugging tool for ourselves. It turned out to be the thing customers actually evaluate us on.
Give it one repository and see what comes back.
Twenty runs a month, free, with the same permissions and the same transcripts as every other plan.