Runtime for agent-built internal tools
The cloud for the tools your teams build.
Turn agent-built tools into governed internal software. Deploy from the same terminal or IDE where the code was created. Identity, permissions, secrets, network policy, and audit logs arrive with it.
Deploy this sprint tracker for the engineering team. Keep it private and use our existing SSO.
Read package.json, auth.ts, acss.yaml
Ran npm test
Running acss deploy ./sprint-tracker
$
- ✓ build complete
- ✓ organization policy applied
- ✓ live at sprint-tracker.internal.acme.com
service: sprint-tracker
+owner: eng-platform
+identity: okta-sso
+access:
+ groups: [engineering]
+network: vpc-private
+audit: siem-export
+secrets: vault-injected
Resolved organization policy default-internal
Created identity boundary okta-sso
Attached roles viewer, editor, owner
Injected 2 runtime secrets
Deployment healthy
One command, the whole handoff
The agent finishes the app.
acss finishes the infrastructure.
No ticket, bespoke pipeline, or second deployment surface. The same action that makes the tool live also makes it governable.
The tracker is implemented and tests pass. I can deploy it now.
acss deploy ./sprint-tracker↵- 01BuildPackaged and health-checkeddone
- 02IdentityConnected to company SSOdone
- 03AccessRoles scoped to groupsdone
- 04NetworkPrivate route createddone
- 05AuditEvents streaming to SIEMdone
Governance as a reviewable change
Every security decision is explicit and inspectable.
Every control attached by acss is explicit, inspectable, and versioned alongside the service.
1identity: okta-sso
2provisioning: scim
3session: company-managed
4public_signup: false
Service inventory
Know every tool, owner, and boundary.
See what exists, who owns it, which agent built it, who can access it, where it runs, and whether it is live.
See what exists, who owns it, which agent built it, who can access it, where it runs, and whether it is live.
run_01J7F2C · sprint-tracker
- 01Intent capturedp.koomen asked the CLI agent to deploy the engineering sprint tracker.
prompt sha256:7a8f…c12d - 02Source and agent identifiedCLI agent · workspace trusted · commit 8d31a7 · 7 files changed.
repo github/acme/sprint-tracker - 03Build evidence createdTests passed, dependency scan clean, image and SBOM generated.
image sha256:b941…98ae - 04Organization policy evaluatedOwner, SSO, group access, private network, secrets, and audit policy approved.
policy bundle org-default@v42 - 05Deployment recordedVersion 18 promoted to the private company runtime.
sprint-tracker.internal.acme.com - 06Runtime events linkedFirst access, agent actions, permission checks, and SIEM events attach to this run.
trace id tr_7f29c0
- Public network requested5
- Owner missing3
- Unapproved secret scope2
- Data residency mismatch2
Organization
Global guardrails
Approved agents, identity providers, regions, data residency, retention, and default network posture.
- Agent allowlist
- SSO / SCIM
- Residency policy
- Audit retention
Service
Ownership and access
Every tool receives an accountable team, company identity, group-scoped roles, and a declared data boundary.
- Owner required
- Viewer / editor / owner
- Group grants
- Service identity
Runtime
Infrastructure boundary
Control where code runs, what it can reach, which credentials it receives, and how resources are constrained.
- Cloud / VPC / on-prem
- Private ingress
- Egress policy
- Runtime secrets
Every agent run
Traceable execution
Link each prompt or task to the agent identity, source changes, tool calls, tests, policy decisions, artifacts, and runtime outcome.
- Initiator + agent
- Prompt / task hash
- Commit + diff
- Policy verdict
- Artifact provenance
- Runtime events
Built for the gap after generation
Coding agents can create the software. They still need somewhere responsible to put it.
Agent-native
Invoked from a terminal, editor agent, CI job, or remote coding environment. No separate builder UI required.
Private by default
Internal tools are not public links. Exposure is a deliberate policy change, not the default result of publishing.
Governed from first deploy
Ownership, access, auditability, and runtime boundaries attach before the service becomes available.
Design partner access
Give every coding agent a safe place to ship.
We are onboarding teams already using coding agents alongside Okta, Azure AD, Google Workspace, or internal SSO.