Everything it does. And everything it does not.

Per-agent mailbox address

Each published agent gets its own addressable mailbox that external senders can write to.

Inbound arrives by provider webhook. We do not operate MX or SMTP.

Inbound classification and quarantine

Arriving mail is classified and risk-scored before it enters agent context; suspicious messages are held.

Contact vault with tiered redaction

The agent sees a projection of a contact appropriate to its disclosure tier, not the raw record.

Outbox with scheduled and cancellable sends

Outbound mail can be queued and withdrawn before it leaves, so a send is a decision with a window.

Redacted owner digest

Opt-in summary of mailbox activity, with the same redaction rules applied to the summary itself.

Escalation to a human

When the agent cannot answer, it hands the question to the owner, who replies asynchronously; the answer reaches the asker by verified email.

Scoped to a "founder answers their own users" pilot and currently free; it has to be re-priced before it could carry third-party experts. Needs a second per-folder opt-in on top of the flag.

Speech to text

Self-hosted recognition with per-language provider routing.

Text to speech

Self-hosted synthesis with sentence-level streaming, so a reply starts speaking before it finishes generating.

Turn-taking and interruption

A turn gate manages barge-in so a spoken exchange is not a walkie-talkie.

SMS send and receive

Text messaging path through a carrier provider.

Built but gated off by default, and requires a carrier account before it does anything.

Inbound or outbound phone calls

Placing or answering an actual telephone call.

Not built. Voice calling was explicitly out of scope and remains so.

English and Indic speech

Recognition and synthesis routed to a provider chosen per language.

These locales need no gate. The wider catalogue does; see the next row.

The wider language catalogue

Speech and translation across a 48-locale catalogue beyond English and Indic.

Needs both a feature flag and a server-side credential mode. Guest voice cannot use these locales at all, as a spend guard.

Translating your documents

Translating folder documents, catalog leaves and uploaded files.

Not built. Translation covers session notes only; there is no backend for document translation.

Visitors can talk to a published agent

Anonymous visitors get a microphone: speech in, spoken answers back, and a full hands-free mode.

Public voice is restricted to the self-hosted providers; paid locales are refused on public links until spend control ships. Limits are per agent, not per visitor, so one heavy visitor can exhaust the day's budget for everyone.

Validated scheduling link

The agent emits a booking call-to-action pointing at your existing tool, checked against an allowlist.

This is the entire calendar capability today.

Availability and free/busy reasoning

Reading a calendar to reason about when someone is free.

Not built. There is no calendar model behind the link.

Google or Outlook sync

Two-way synchronisation with an external calendar.

Not built, and not currently scheduled.

Folder tree with cascading config

A plain-text config file per folder whose settings cascade down the tree, like directory-scoped config in a codebase.

PDF, spreadsheet and transcript extraction

Uploads are parsed to text, scrubbed of personal data, and staged before they become retrievable.

Exotic binary formats are stored but not parsed.

Draft → stage → test → publish

New grounding material goes live as a deliberate step, not as a side effect of dropping a file.

Agent-uploaded documents

An agent adding a document to its own corpus during a conversation.

The upload tool exists; treat automatic self-grounding as unproven.

Download, export and share a whole agent

Exports an agent (folder tree, config, knowledge as logical paths) as a single downloadable file, shareable with anyone, and installs into another account additively with a plan-before-apply step.

A portable copy, not a backup: it carries no ids, credentials, verification status or embeddings. Installed knowledge arrives as drafts you must index and publish. There is no signing and no merge into an existing agent.

Download and share a workflow

Exports a whole workflow as a downloadable package carrying a redacted real run, so someone can watch it work before installing it.

Deliberately a curated list and private links, not a marketplace; open submission was refused rather than ship an empty storefront.

Split-pane config editor

One engine and one write path for editing an agent's config, reachable as a full editor, a readout pane, or an overlay drawer.

Below Pro this falls back to the older single-pane editor.

Images in published answers

Photos become caption-text leaves; in chat the model emits a marker that is validated against a per-turn allowlist and rendered as a masked-reveal card from private storage.

The deepest-gated capability we ship: it needs two separate flags, both off by default, on the Enterprise preset only. The model never sees or writes a URL.

Page landmarks for a site-embedded agent

Unresolved visitor questions become a backlog; confirming a named landmark on your page resolves them and powers precise on-page answers.

The cores and matching are built; the capture studio you would use to author landmarks is not. One wiring step is also open, so landmark-precise answers quietly fall back to keyword matching today.

Visitors can attach files

A visitor can upload a file into the conversation for the agent to read on that turn.

Five megabytes, six file types, and content is sniffed by magic bytes so a renamed extension will not pass. Uploads are ephemeral (one hour, then gone) and never join your folder.

Chunked, embedded document index

Documents and transcripts are chunked and indexed for retrieval at answer time.

Grounding receipts on answers

The passage that produced a claim is attached to the claim, rather than reconstructed afterwards.

Hybrid vector + keyword + centrality scoring

Combines similarity with exact match and graph centrality, which is what keeps rare identifiers findable.

Code-complete; the vector store deployment and backfill are not finished.

Persistent cross-session agent memory

Distilling conversations into a durable profile the agent carries forward.

Not built. Session history is kept; it is not distilled into persistent memory.

Conversation history sidebar

Signed-in visitors to a published agent get past conversations, click-to-switch, and history across sibling agents.

Cross-agent history is scoped to the same tenant and the same email address.

Answers grounded in your website page content

The embedded agent reads the host page's visible content at send time and answers from that page content as well as from your folder, so it can talk about whatever the visitor is currently looking at, including on a single-page app.

Visible text only, capped at 8,000 characters, fetched per message with a 2-second timeout; a slow page silently yields none. It is injected into the prompt as clearly-delimited untrusted data, never indexed or ranked alongside your documents. Needs two opt-ins: yours, and the host page's. Embed only.

Unanswered questions become a backlog

When the agent refuses a question for lack of grounding, the question is redacted and written to a demand backlog, so what visitors wanted and did not get becomes the list of what to add next.

Capture is best-effort and never blocks the visitor's reply. The weekly digest that summarises it is a separate opt-in.

Connected sources in guest answers

A visitor's question can be grounded by the owner's connected sources as well as uploaded documents.

Best-effort: a connector failure degrades that turn to document grounding rather than failing it.

Policy-aware knowledge tags

Tags derived from grounding material and connectors, filtered so a tag cannot leak the existence of a restricted source.

Tiered scope classification

Cheap pattern matching first, embedding comparison only when the cheap tier is unsure, deciding if a question is in scope.

Runs, but tuning is per-deployment rather than a product surface you configure.

Author your own hierarchy

Defining and maintaining a formal taxonomy with inheritance.

Not built. Tags are derived, not authored.

Per-leaf and per-folder access policy

Public, signed-in, or owner-approved, set on an individual document as well as on a folder.

Access envelope filters retrieval

Permissions narrow the corpus before generation, so a document you cannot open cannot be paraphrased at you.

Fail-closed on unresolvable policy

When policy cannot be resolved the safe answer is refusal: the embed policy, for instance, falls back to framing nowhere.

Per-tenant capability gating

A feature registry with presets and bundles decides what a workspace can reach at all.

Instant propagation of a permission change

A revocation taking effect on requests already in flight.

Policy is cached per session and invalidated on change. Fast, but not a guarantee about in-flight requests.

Per-leaf visibility matrix

One view of exactly which documents a guest can reach, with conflict, orphan and excluded-subfolder warnings.

Renders only from the server-computed matrix and never recomputes client-side, so what you see cannot drift into over-exposure.

Your own domain

Serves a published agent (chat, tools, discovery and sign-in) on a domain you own, as a first-class host rather than a proxy.

Requires the multi-tenant control-plane deployment, because the domain-to-account map cannot live in a per-account database.

Which sites may embed your agent

An exact-origin allowlist decides who can frame your agent, enforced at parse, sanitise, resolve, policy and render: five independent layers, every one of which fails closed.

Exact origins only (no wildcard subdomains) and a maximum of twenty per agent. A cold edge instance during a database outage refuses to frame rather than guessing.

Per-edge trust decision

Agent-to-agent requests resolve a decision before execution; an unauthorised call never reaches the model.

Scoped single-use caller tokens

A delegation carries a token minted for that hop and tracked in a ledger, not a reusable credential.

Tiered disclosure

A decision can permit an answer at reduced disclosure instead of choosing between full access and refusal.

Admin audit of trust decisions

Decisions are recorded per edge and visible to administrators.

End-user "why was this blocked" explanation

Surfacing the reasoning behind a denial to the person who hit it.

Enforcement is solid; the explainability surface on top of it is thinner than the enforcement.

Named agent addresses

Human-readable per-tenant handles, so an agent lives at a name rather than an opaque token.

The handle is an address, never a credential. Rotating an agent's token does not yet preserve guest chat sessions.

Verified owner badge

The human owner verifies identity once through a hosted identity provider; every agent they own derives its badge from that single check.

Fast path only. Config files are never trusted as a source of verification status: an owner could edit them, so the field is stripped on read and write.

Federated agent card

Publishes a signed, token-less card at a well-known address so external directories can resolve and call the agent.

Strictly one-way: we publish outward and do not call external agents. There is deliberately no central directory and no enumeration; you have to already know the handle.

Publish an agent to a public address

A live page anyone can open with no account: streaming answers grounded in your material, citations, the agent's identity card, and a clean refusal when a question is not covered.

Published agent pages are noindex by design: a link unfurls beautifully in chat but accumulates no search ranking. The off-topic refusal gate is also English-only today; other locales skip it.

Social cards when a link is shared

Pasting an agent link into Slack, X or WhatsApp renders a generated card with the agent's name, its disclosure tag and a verified badge where earned.

Fails soft: any error renders a generic branded card rather than breaking the unfurl, so a cold start can produce an anonymous-looking preview.

Agent-to-agent discovery and fan-out

One question to your agent reaches complementary agents across the network: each hop gets its own scoped token, and each recipient's own disclosure gate decides what comes back.

Discovery runs over a curated, approved tag graph; it is not open discovery of arbitrary agents. The durable, resumable mode needs external workflow infrastructure; without it you get synchronous fan-out inside a 45-second budget.

MCP server with OAuth 2.1

External clients can use your agents as tools, through a real resource server with scope checks.

Approval policy on tool calls

Which tools may run unattended and which require a human decision, with calls written to a session ledger.

Any remote MCP server as a connector

Adding a third-party tool server is configuration, not per-provider code.

Authenticates with a static bearer token today.

Circuit breaker on failing tool servers

A misbehaving remote degrades one capability instead of the conversation.

OAuth 2.1 for custom remote MCP servers

Full authorisation-code flow against a third-party tool server you bring.

Planned, no code yet. Static bearer token is the only option today.

Gmail and Drive connectors

Native OAuth adapters that ground an agent in your mail and documents.

These are the only two native adapters, and that set is deliberately shrinking; everything else is expected to arrive as a remote MCP server.

Visitor-facing tools on a published agent

A "what I can do" manifest plus egress tools a visitor can trigger: share card, translate, PDF, email-me.

Guests never execute code: the compute endpoint returns 403 for a guest by architectural assert. Each agent also needs the tool named in its own allowlist.

Sandboxed Python compute

The agent writes Python, runs it over grounded data in an isolated container, and returns a signed execution receipt.

Verified as a proof of concept on a local machine with plain container isolation. It is not deployed anywhere with the stronger sandbox runtime, and the runner is behind an opt-in compose profile. Treat it as unproven in production.

Live web reading

Fetching a page during a conversation through an isolated runner behind an egress proxy, returning a signed browse receipt and a freshness badge.

Code-complete but runtime-unverified. The domain allowlist is empty by default, which means deny-all, and the stricter browser engine must stay off until an open redirect re-check gap is closed.

Rented cloud browser for owner preview

Replays a saved journey against your real site in a cloud browser so you only publish once every step actually resolves.

Server side is built; there is no user interface for it, and a vendor data-processing review has not been completed. Visitors can never trigger it; the per-visitor cost would be unbounded.

Drop-in embed widget for your own site

Two script tags put the agent on your website as a shadow-DOM launcher plus a sandboxed iframe. Every credential and API call stays inside that iframe on our origin, never in your page.

It renders nowhere until you allowlist your domains: two independent fail-closed gates see to that, which is a real setup step rather than paste-and-go. The shipped snippet has no subresource-integrity hash.

The agent can act on your page

With page actions enabled the agent can locate an element, highlight it for the visitor, and click it, after the visitor confirms.

In practice this is locate, highlight and one confirmed click: typing and scrolling exist in the engine but are not wired to any UI. A click is only ever performed against an exactly-resolved element; a fuzzy text match highlights and refuses to guess.

Hand off to a sibling agent in place

The widget can swap to another of your agents inside the same frame, carrying the visitor's last question across, without navigating your page.

Embed only. On the standalone published page the switcher navigates normally.

Durable agent task ledger

Tasks, events, delegation edges and artifacts as Postgres rows, so a restart does not lose the trace.

Replay, retry and cancel

Interventions against a running task are themselves recorded, so the intervention is part of the timeline.

Typed in-process event bus

Around ninety typed domain events delivered to subscribers within a node.

Single-node emitter. Not a distributed broker, and we do not describe it as one.

Cross-instance event delivery

Events fanned out to subscribers on other nodes.

Not built. Durability across instances comes from the Postgres task ledger instead.

Playbooks

Written procedures an agent follows step by step, authored as ordinary markdown, with a dial for how strictly to adhere.

Two of the three adherence modes ship. Deterministic execution (the mode where the platform guarantees the steps rather than the model following them) is not built.

Batch execution across many agents

Runs one playbook against many agents at once, each as an independent durable workflow, with verification gates and a live dashboard.

Has no gate of its own: it rides the playbooks flag. A playbook is snapshotted when a batch starts, so edits mid-run only affect the next batch.

Visual agent-graph canvas

Chain agents into a graph, wire named outputs into downstream inputs, publish a frozen snapshot and run it.

Writing results back into documents is a second, separate gate, and what it writes lands as a draft that will not ground until you promote it.

Live event rooms with a projected wall

Time-boxed rooms where a host projects checked-in agents, publishes approved question cards, and moderates from a console.

Built and tested, but in no plan preset at all: not even Enterprise. Nobody has this switched on today, and rooms are single-tenant until a host opts into interoperability separately.

.agentpkg export

Serializes an agent, its folder tree, config, knowledge and workflows into a portable ZIP archive with a manifest and provenance record.

Three-step install flow

Plan (inspect with zero writes), Review (verify a digest), Apply (TOCTOU check then write). A package that changed between review and apply is rejected.

Private handoff links

A time-expiring share token for peer-to-peer distribution without a public listing.

Curated showcase

A gallery of packages with verified proof-of-concept sample runs, so someone can watch a workflow work before installing it.

Deliberately a curated list and private links, not a marketplace. Open submission was refused rather than ship an empty storefront.