Every action is checked for scope, policy, safety, and budget before it happens, on every tool call, every payment, every write. What passes lands in a signed, hash-chained Operating Record you can verify offline. Self-hosted, air-gapped, or hosted by Daybreak Labs: log in and go.
Every action passes through this gate before it runs. An agent cannot do anything Lightwork didn't watch and record.
The kernel runs and governs the work; the other six parts plug into it.
The runtime that runs and governs the work. It holds without the shield, never requires it.
Inspects each action for the dangerous call and the prompt injection before it clears the gate.
How work comes in and goes out: the governed surface between agents and your systems.
Inboxes and sign-off, plus a live force-directed map of every goal. Where a person reviews, certifies, and releases what an agent produced.
An MCP server. Run Lightwork from Claude Code, Cursor, or any MCP client.
The closed, audited loop that lets the workforce improve, and prove it. Lessons that survive the proof are written back to Cortex.
Memory scoped per department, plus fleet memory that governs external agents: the package that keeps Cortex, the company brain, tenant-exact and under audit.
Three mechanisms, enforced at the gate, not bolted on after the fact.
Attenuate-only. An agent narrows its rights to the task in front of it, and can never widen them.
Allow, deny, or require a human, bound to every action, not bolted on after the fact.
Outbound traffic is allow-listed per tenant, model calls and HTTP tools alike, so a successful prompt injection still can't move data out.
Tamper-evident and verifiable offline. Each entry signs the one before it. Alter a row and the chain breaks.
Hard budget caps on tokens, dollars, wall-clock, and tool calls. The sandbox runs network-off by default.
Fig. 05 · The four budget caps are hard: a runaway agent stops at the cap, not after it. The sandbox starts with the network off.
A closed, audited loop, off by default and reversible by snapshot. Every proposed change is validated for real, causal improvement before it is promoted, graded on real outcomes once it ships, and rolled back automatically if the lift doesn't hold. No change touches behavior on a hunch. What survives becomes a lesson in Cortex, where the next agent to face the same case finds it.
Every proposed change is tested for real, causal lift on work it hasn't seen before it is allowed to change behavior. Nothing ships on a hunch.
A change ships watched and graded against real outcomes. It earns its place from wins, or it is pulled automatically when it stops paying its way. Failures win ties.
The whole loop is off by default and reversible by snapshot, and the judge that scores improvement is held to a locked benchmark, so self-improvement can never grade its own homework.
The workforce's own pass-vs-fail runs, held in Cortex, are what a change is judged against, and a release can't ship unless the improvement survives a placebo control and clears the release gate in CI. The full learning architecture is covered in a technical deep-dive we share with design partners under NDA.
Turnkey departments of least-privilege specialist agents across finance, tax, legal, privacy, GRC, operations and more, every one of them running under the same governance gate.
Every specialist pack clears the same quality gate: 0 errors, 0 warnings, on every build.
Every product in the line is built on this runtime: the same governance gate, the same Operating Record, the same company brain.
An analyst pack's work cites an authoritative source instead of recalling one. What it retrieves is kept in Cortex with its citation, so every answer says where it came from.
Every analyst pack is auto-granted dozens of read-only public-data connectors, spanning public filings, economic and market data, federal registers, health and clinical data, and weather. Read-only and low-risk by default, with one kill-switch to turn it off.
Write-capable enterprise connectors (Salesforce, ServiceNow, Stripe, Snowflake) sit behind confirm-gated approvals.
A live golden path refuses the dangerous action and leaves a receipt for every decision. A single step signs an offline-verifiable evidence bundle.
GATE and BENCH are our own internal release-gate results, not third-party certification, and imply no contractual SLA. Methodology: property-fuzzed governance invariants with a non-vacuity control, and held-out-work evaluation with a placebo control — detail on the Security page.
A goal's result renders as a typed deliverable, routes to a per-role inbox, and waits for a human to certify it, then routes into Salesforce or ServiceNow, signed and audited.
Two machine-readable reports and one view, so a pipeline can check spend and posture without opening a dashboard.
A JSON spend report exports total, per-goal, and per-tag run cost for chargeback and BI.
A machine-readable safety report prints shield status, sandbox isolation, and egress policy, so a pipeline can assert your deployment posture without opening a dashboard.
The billing view shows accrued charges, a period-over-period trend, and an itemized CSV invoice.
Self-hosted, air-gapped, or hosted by Daybreak Labs: log in and go. The same gates, the same record, and your own keys either way.
We're working with a small number of design partners in regulated industries. If that's you, let's scope one workflow.
