A secure way to run enterprise AI agents.

Building blocks for running enterprise agents in your own cluster, on the models you choose. The AI never decides what it’s allowed to do. OAP checks every action before it runs.

How it stays secure
$ mage desktop:all
$ open build/desktop/out/oap.app
# a local VM with a menubar app. No Kubernetes needed.
Watch one: reviewbot reviews a pull request read-only and records a Check Run.

Before you trust an agent with real work, you need answers to four questions.

  1. What can it reach?The problem
  2. Who said it could?Authorization
  3. What if a tool result tells it to do something else?Injection
  4. If one piece is compromised, what’s exposed?Isolation

OAP answers all four in the platform, before the agent acts. See how

The problem

Your agent can reach everything its credentials can.

A token for one repository usually reaches every repository. An agent inherits all of it.

A model can’t reliably tell instructions from data, so its judgment can’t be the boundary. A better prompt is still just an instruction.

So OAP enforces every rule itself, before each action runs, where no prompt can change it.

QuestionTypical platformOAP
What an agent can reachWhatever its credentials allowExactly what you granted
Who decides an action is allowedThe model, in the momentThe platform, before the call
An injected instruction mid-sessionCan redirect the agentCannot widen what it's authorized to do
Tool credentialsVisible to the model and every toolInjected for the tool that needs them, never shown to the model
Restricting an MCP serverNeeds a narrow upstream tokenDeclared by you, enforced per call
Revoking accessRotate credentials, redeployOne permission graph call
The audit logAppend-only, enforced by the storeSigned, chained, verifiable offline

The primitives

Six concerns every agent has to solve.

A primitive is a basic building block that agents rely on, whatever they do. OAP ships a working implementation of every one.

  1. #1 Define

    Agent definition

    An AgentClass is a reviewable, versioned template. Each AgentSession gets its own isolated runtime, budget and audit trail, and is torn down when the work is done.

  2. #2 Constrain

    Safe tools

    A tool is a declarative contract, checked when it is written and again when it runs. Calls execute in a hardened sandbox, with no shell interpolation of arguments.

  3. #3 Broker

    Identity & credentials

    An agent acts as itself or on a person's behalf. It gets the use of a credential without being given it: a broker injects it into the tool that needs it, and the model never sees it.

  4. #4 Decide

    Authorization

    Every action is checked at the moment it runs: may this agent, or the person it acts for, do this to this resource? The agent asks; it never answers.

  5. #5 Carry

    Channels & continuity

    Agents work in Slack, the browser, the CLI and GitHub. Every message and approval click is checked against who sent it before it counts.

  6. #6 Remember

    Memory & knowledge

    One store holds what the agent learned and a signed record of what it did. Every read is checked item by item against who is asking.

OAPThe primitives

Six primitives

Scroll to view6 cards

What makes it secure

Controls in six areas.

The platform enforces every control. No prompt or tool output can affect enforcement.

Every action is authorized

  • Checked per action. Tool calls, memory, lookups and interactions all go through one permission graph.
  • Operation-level rules. One agent can be read-only for one team and read-write for another.
  • Directory sync. Groups from Slack, GitHub and 1Password keep permissions in step with your organization.
  • Multiplayer sessions. Joining, directing and sensitive tools can each require approval.

AuthorizationIdentity modesMultiplayer

Injected instructions can't widen access

  • Plan gating. A person approves the agent's plan, and every later action is checked against it.
  • Slots. A session commits to one resource and cannot drift to another.
  • Approvals the model can't reword. The platform describes the action from the call itself.
  • Tool specs. Make a read-write integration read-only without a read-only token.

Plan gatingTool specs

Data reaches only its audience

  • Leakage tracking. Data is tagged with its origin and checked against who will receive it.
  • Slot-scoped memory. One customer's context never reaches another customer's session.
  • Secret scrubbing. The model sees an opaque handle in place of the value.

Information leakageMemory authorization

Least privilege by default

  • Opt-in capabilities. No tool or capability is granted until someone adds it.
  • Isolated sandboxes. Credentials are injected only for the tool that needs them, and the model never sees them.
  • Narrowing delegation. Sub-agents request their own permissions instead of inheriting yours.

Sandboxed executionSub-agents

Control and oversight

  • Inherited policy. Cluster, namespace and class defaults that agents can't opt out of.
  • Revocation. Remove one relationship and the next action is refused, with no credential rotation or redeploy.
  • Verifiable audit. Signed, hash-chained entries, checked offline with oap audit verify.
  • Pinning and budgets. Approved versions, capped spend and circuit breakers.

Audit logRevocationPinning

Isolation in the platform

  • Sanitized output. Each content type has its own sanitizer, and rendered output runs under a strict CSP.
  • Separate pods. Runner, operator and sanitizers run in separate pods, and tool sandboxes can run on micro-VMs where the cluster provides them.
  • Scoped credentials. Every component gets its own bus credential, and a session's pods can publish only on that session's channels.
  • Reviewable packages. Each agent ships as one OCI package you can gate like any artifact.

Artifact safetyPackaging

Plan gating and leakage tracking are opt-in per agent class. Network policy is on by default.

Agent Builder

Build an agent by talking to an agent.

Agent Builder is an OAP agent that creates other agents. Describe what you need in plain language, then test it live.

  1. Describe

    Say what it's for

    Agent Builder picks the tools, connects accounts, and sets what the new agent may do.

  2. Test

    Try it in a workshop

    Drafts run in isolation and can't touch your live agents.

  3. Deliver

    Hand over a bundle

    You get a portable .oap bundle for an administrator to review and install.

Read the Agent Builder guide

Off by default. You turn it on by naming who may use it, and it follows every control above.

Everything else

The rest of the platform, included.

The capabilities you’d expect from any agent platform.

Your choice of model

Anthropic, OpenAI or OpenRouter, swappable per deployment.

Your infrastructure

A laptop, a local cluster, GKE, EKS, AKS or self-managed Kubernetes.

Channels

Slack, the browser, the CLI and GitHub, plus signed webhooks and scheduled runs. Transports are pluggable, so you can add your own.

Memory and knowledge graph

Structured recall, ranked search and graph queries.

Built in and swappable

The runner, authorization, approvals, sandboxing, credentials, memory and audit ship built in. Model providers, sandbox backends, memory stores, channels and artifact storage plug in through interfaces, so you can use what you already run.

Under your control

OAP runs inside a cluster you operate. Your team owns its network, access and upgrades.

Security posture

Coverage of the OWASP Agentic Top 10.

How OAP maps to each risk in the OWASP Top 10 for Agentic Applications, with the remaining gaps listed alongside. Each item links to its full write-up.

4 substantial · 6 in progress
ItemRiskCoverageNot yet
ASI01Agent Goal HijackIn progressGoal-lock and plan-divergence detection aren't built yet.
ASI02Tool Misuse and ExploitationSubstantialEgress is enforced at L3/L4 so far, and volume budgets are per call and opt-in for now.
ASI03Identity and Privilege AbuseSubstantialSidecar credentials are fixed when the pod starts, and revocation is delivered at most once for now.
ASI04Agentic Supply ChainIn progressA hash pins content but not yet origin. Descriptor signing and an SBOM or AIBOM aren't there yet.
ASI05Unexpected Code ExecutionSubstantialIsolation is per session for now: tool calls within one session share a UID, /proc, /tmp and /work.
ASI06Memory and Context PoisoningIn progressWrites aren't content-validated yet, and quarantine, decay and rollback aren't built yet.
ASI07Insecure Inter-Agent CommunicationIn progressDelegation stays within one cluster for now; a protocol for agents outside it isn't there yet.
ASI08Cascading FailuresIn progressBreakers work per tool and per origin; cross-cutting breakers aren't there yet.
ASI09Human-Agent Trust ExploitationSubstantialA plan-divergence cross-check and confidence-weighted cues in the UI aren't built yet.
ASI10Rogue AgentsIn progressThe tool manifest is enforced but not signed yet: it's tamper-evident, not tamper-proof.
Read the coverage map

How we know the gates still hold

Every merge runs whole-session scenarios, golden authorization traces and replays of real sessions. A permission check that stops working fails the build.

Based on the OWASP Top 10 for Agentic Applications (2026) by the OWASP GenAI Security Project, licensed under CC BY-SA 4.0. This assessment is not affiliated with or endorsed by OWASP.

Defense in depth

Every layer assumes the others may fail.

To misuse an agent, an attacker has to get past an approved plan, a locked slot, a check on every call, a tool spec, and a sandbox. The model never sees a credential.

Get startedRead the docsSource