Security. What agents can touch, what they can't, and every gate in between.
An agent with access to production should have to earn every write. Everything below is how the product actually behaves.
Write access is earned, not assumed. Agents read everything and change nothing until a human says otherwise.
Read-only by default
New cloud accounts connect read-only. Write calls are refused until you turn read-only off, per account.
Approval on every cloud write
The run pauses and shows the exact call: method, path, body, reason. Approve it, or reject it with a note the agent reads.
A safety review even after you opt in
With read-only off, every mutating call still passes a safety review.
Code ships as pull requests
Fixes land as pull requests for your review. Polylane merges only where you enable it, per automation.
Rollbacks are off by default
Enabled per automation, by you. Receipted, rate-limited, and revocable at any time.
Coding-agent writes are double-gated
Over MCP and the CLI, write tools need the agent_tools:write scope and a per-session opt-in header. Every write is then screened by a safety model.
Least privilege, end to end. Connections ask for the minimum, credentials stay sealed, every key is scoped.
Connections ask for the minimum
AWS through a scoped CloudFormation role, Cloudflare with pre-filled token permissions, GitHub and Sentry as apps. No provider gets a god-mode key.
Credentials are sealed
Encrypted with authenticated encryption before storage. Agents never see them: tool calls run through Polylane's adapters.
API keys are scoped and revocable
One workspace, an explicit scope list, shown once. Deletion is immediate: the next request returns a 401.
OAuth done properly
Authorization code with PKCE. One-hour access tokens, single-use refresh tokens, immediate revocation.
Roles for people too
Owner, admin, member, read-only. Admin-only actions stay admin-only through the API.
Sandbox secrets are encrypted
Repository environment secrets are encrypted before storage.
Evidence, not vibes. If an agent can't show its work, its conclusion doesn't count.
Claims link to evidence
Answers link back to the query, log line, or change record behind them. Tool results stay in the transcript.
"Confirmed" requires data
A verdict without evidence falls back to inconclusive. An investigation that couldn't reach data never confirms.
Full transcripts, kept
Investigations, automations, and fixes run as threads you can watch live, interrupt, and audit after the fact.
Detection leaves an audit trail
Every evaluation is a recorded check run. Metric-backed series keep the exact query behind them.
Bounded by design. Caps on actions, on spend, and on your providers' APIs.
Investigation caps
Automatic investigations are capped per rolling 24 hours: 10 on Free, your own cap on paid plans.
Spend caps
Agents pause at plan limits, with warnings at 70% and 90%. Overage is opt-in and stops at a cap you set.
Your providers' rate limits, respected
Monitoring acquires a budget slot before calling a provider's API and backs off when it's exhausted.
Your infrastructure, on your terms. Shared deliberately, scrubbed when public, gone on a schedule.
Nothing public by accident
Threads stay inside your workspace. Public sharing is a separate, deliberate step.
Public pages are scrubbed
Public reports strip account, region, and connection identifiers. Shared topology is display names only.
Finite retention
Change records: 30 days or the most recent 5,000 per account. Scan reports: the 50 most recent per connection.
Bring your own model
Team plans bring an LLM provider key; inference runs under your provider agreement. Enterprise adds your own AI gateway, including self-hosted models.
Found a vulnerability? Email boris@coreplane.ai. It goes straight to the founder; we respond within two business days. Third parties that process customer data are listed at /subprocessors.