Capability, policy, shield, budget, audit, in that order, on every tool call, every payment, every write, before it happens.
Every action passes through this gate before it runs. An agent cannot do anything Lightwork didn't watch and record.
The runtime that runs and governs the work. It holds without the shield, never requires it.
Inspects each action for the dangerous call and the prompt injection before it clears the gate.
How work comes in and goes out: the governed surface between agents and your systems.
Inboxes and sign-off, plus a live force-directed map of every goal. Where a person reviews, certifies, and releases what an agent produced.
An MCP server. Run Lightwork from Claude Code, Cursor, or any MCP client.
The closed, audited loop that lets the workforce improve, and prove it.
Memory scoped per department, plus fleet memory that governs external agents.
Attenuate-only. An agent narrows its rights to the task in front of it, and can never widen them.
Allow, deny, or require a human, bound to every action, not bolted on after the fact.
In Enterprise mode the agent's outbound paths, model calls and HTTP tools alike, are blocked at the gate, so a prompt-injected agent can't exfiltrate through them.
Tamper-evident and verifiable offline. Each entry signs the one before it. Alter a row and the chain breaks.
Hard budget caps on tokens, dollars, wall-clock, and tool calls. The sandbox runs network-off by default.
A closed, audited loop, off by default and reversible by snapshot. The harness rewrites itself, validates every edit for causal lift before it promotes it, and grades it on real outcomes once it ships. No change touches behavior on a hunch.
It mines its own failure traces into one minimal guidance line per weakness, regression-tests it on a held-out corpus, and only then promotes it. A weakness learned for one model never leaks into another's harness.
A promoted line ships watched, graded against real outcomes. It earns permanence from wins, or it is pulled automatically when it stops paying its way. Failures win ties.
When the evaluator stops discriminating, a challenger can replace it, but only if it beats a checksum-locked, CI-enforced ground-truth anchor. Self-improvement can't grade its own homework.
Underneath: offline consolidation (“dreaming”), per-department memory feeding a causal flywheel, and a deconfounded promotion gate that refuses to change behavior unless the effect survives a 64-permutation placebo test. Your fleet's own pass-vs-fail runs become preference-training data, with no hand-labeling. lightwork prove-learning --strict fails CI if a release can't show a significant lift.
Run domains-lint yourself.
Every analyst pack is auto-granted 37 read-only public-data connectors, so its work cites an authoritative source instead of recalling one: SEC EDGAR, FRED, Treasury, FDIC, Census, BLS, CourtListener, the Federal Register, openFDA, ClinicalTrials, PubMed, NWS and NOAA, and more. Read-only and low-risk by default, with one kill-switch to turn it off, alongside a deeper bench of write-capable enterprise connectors (Salesforce, ServiceNow, Stripe, Snowflake) behind confirm-gated approvals.
A live golden path refuses the dangerous action and leaves a receipt for every decision. One command signs an offline-verifiable evidence bundle.
A goal's result renders as a typed deliverable, routes to a per-role inbox, and waits for a human to certify it, then routes into Salesforce or ServiceNow, signed and audited.
lightwork spend --json exports total, per-goal, and per-tag run cost for chargeback and BI. lightwork safety --json prints shield status, sandbox isolation, and egress policy, so a pipeline can assert your deployment posture without opening a dashboard. The billing view shows accrued charges, a period-over-period trend, and an itemized CSV invoice.
Self-host or air-gap, on your data. 8 packages · Docker, K8s, or VPS · MCP server · GitHub Action · plugin SDK · native installers.
We're working with a small number of design partners in regulated industries. If that's you, let's scope one workflow.
