Agents do the work.
People decide what ships.
Every agent acts for a person, inside that person’s rights, with tokens that expire within the hour. Every write is a plan. Production, money and access wait for a person with a passkey; budgets stop work before it spends; and one switch suspends every agent in the organization.
- A
- Who asked, for whomKenji S., through a coding agent on a laptop, calling one tool: the whole chain is on the record.
- B
- Why it needs a personDestructive tools always wait for a person, by an organization rule; the agent’s ceiling only lets it ask.
- C
- Exactly what happensThe plan, step by step, with its write modes and its hash. Nothing outside it can run.
- D
- Approve with a passkeyStep-up if you last confirmed more than 10 minutes ago; if the target changes first, the plan is void.
Approvals pinned to the plan.
Not to a chat message.
One approvals engine sits behind every change a person must allow: production deploys, agent writes, access, quota increases, secret versions. An approval names the exact plan, and only that plan can run.
Budgets stop before they spend.
And never delete anything.
Budgets nest from the project down to a single task, and each one is checked before the next call. A model call reserves the most its reply can cost before it runs, so agents stop at their budget instead of running past it. Other usage is checked every few minutes and pauses at the cap.
When a cap is reached
- Workloads on your servers
- Never stopped. Only new billable items are refused
- Agents, runners and model calls
- Paused: agent sessions suspend, runner jobs stay queued, model calls are refused with a plain message
- Serverless endpoints
- Scale to zero; requests get a plain message
- Storage and data
- Keeps serving. Nothing is deleted
- Alerts
- At 50, 90 and 100 %, and on the forecast
- Lifting a cap
- A billing admin, with a reason. Never an agent
One door to every model.
With guardrails on it.
Sessions, agents, boxes and services reach models only through the Frazer LLM gateway, with short-lived keys. Guardrails run before any cache lookup, and a key can only choose a stricter policy than its project.
| Check | When | Default |
|---|---|---|
| Secrets in prompts | before the call | Blocked; the value is hashed, never stored |
| Personal data | before the call | Masked, and restored in the reply |
| Prompt injection in tool results, pages and tickets | before the call | Labeled; blocked above 0.9 for agents that can write |
| Secrets in replies | in the reply | Redacted, also while streaming |
| Data policy | per request | Blocked if a step could reach a provider that keeps or trains on data |
| Cost per request | per request | Blocked above a limit, $2.00 by default, with the estimate shown |
Logs keep metadata only by default. Zero-retention mode is set per project. Keys never approve anything.
Agents act for you.
Never as you.
An agent can only do what its ceiling, your rights at that moment and its token all allow, minus anything denied. It never holds a stored credential: secrets reach it as references through the credential broker, and people can write a secret but not read it back.
Nothing long-lived
- Box connection
- one hour, bound to the person, the box and the device
- SSH certificate
- eight hours
- Model token
- an hour at most, per box or per session
- Agent task token
- an hour at most, for one audience
- Just-in-time access
- up to eight hours, with a reason and approvers
- A revoke
- applies on the very next request
A new agent starts with a read-only ceiling; a coding agent starts at draft pull requests. Every secret read is audited, and break-glass access is always reviewed by a second person.
Every write is on the record.
Who, for whom, and why.
People, agents and Frazer itself act through the same API, so every write is a plan with an audit entry, and every decision has an ID you can explain later: the rule that allowed or denied it, as policy stood at that moment.
10:52:04 plan.create actor=agent:frazer-agent on_behalf_of=user:lena via=mcp plan=sha256:9b1e…c04d 10:53:40 approval.grant actor=user:noah approval=apr_01JA3KQ7 step_up=passkey 10:53:41 plan.apply actor=user:lena for=agent:frazer-agent decision=dcs_7f2c result=ok 10:58:12 tool.denied actor=agent:alert-tuner permission=secrets.versions.access denied_by=principal_boundary
One switch stops every agent.
Smaller ones stop less.
Kill switches come in sizes: an item, a wave or a whole run; one agent, a squad or a campaign; or every agent in the organization at once. Runs trip their own switch when the numbers go wrong.
Who may do what.
Written down, not implied.
Roles are explicit: no basic role implies access administration, token minting or reading secrets. Agents get the narrowest column of all.
| You, as a developer | Approvers | Org admins | Billing admins | Agents | |
|---|---|---|---|---|---|
| Start sessions and fan-outs | allowed: 100 at a time | not their job | allowed: set the limit, up to 1,000 | not their job | within limits: sub-agents, two levels |
| Propose a change | allowed: as a plan | not their job | allowed: as a plan | not their job | allowed: always as a plan |
| Approve a plan | never: never their own | allowed: with a passkey | within limits: when named | not their job | never: never |
| Apply to production | allowed: after approval, step-up | not their job | not their job | not their job | never: never |
| Merge to the default branch | allowed: yes | not their job | not their job | not their job | never: drafts only |
| Grant access | within limits: only what they hold | not their job | allowed: with IAM admin | not their job | never: never |
| Set budgets, lift a cap | not their job | not their job | not their job | allowed: with a reason | never: never |
| Change guardrails and approval rules | not their job | not their job | allowed: yes | not their job | never: never |
| Read a secret’s value | never: write-only | never: write-only | never: write-only | never: write-only | never: references only |
| Suspend all agents | not their job | not their job | allowed: from Security or IAM | not their job | never: never |
- allowed
- within limits
- never
- — not their job
What an agent may never do.
However it is asked.
These are not settings an agent can talk its way around. They are enforced by Frazer, outside the agent’s sandbox, on every request.
- Approve anythingnot a plan, not a grant, not its own work
- Grant accessor hold more than the person it acts for
- Change the rulesbudgets, limits, guardrails or its own hiring policy
- Lift a cap or a quarantineor reset a kill switch
- Hold a stored credentialor read a secret’s value; it gets references
- Verify its own worka verifier from another model family does
- Write the numbers it is measured bykey results come from your sources
- Take another agent’s word as approvalagent-to-agent messages are untrusted
- Merge, or write live to production from a runpeople merge; production is a plan
- Buy serversor spend past a budget
Keep going.
How it works
One piece of work, from a prompt to production, in eight steps on the real screens.
A thousand sessions
Fan-out, waves and budgets, where sessions run, and how results come back.
Tour
Twelve screens of the Frazer app, and every way into the ADE.