Runtime for agent-built internal tools
The cloud for the tools your teams build.
Turn agent-built tools into governed internal software. Deploy from the same terminal or IDE where the code was created. Identity, permissions, secrets, network policy, and audit logs arrive with it.
CLIIDE agentCICloud agent
P
Deploy this sprint tracker for the engineering team. Keep it private and use our existing SSO.
Read package.json, auth.ts, acss.yaml
Ran npm test
Running acss deploy ./sprint-tracker
$
- ✓ build complete
- ✓ organization policy applied
- ✓ live at sprint-tracker.internal.acme.com
acss.yaml+12 −0
service: sprint-tracker
+owner: eng-platform
+identity: okta-sso
+access:
+ groups: [engineering]
+network: vpc-private
+audit: siem-export
+secrets: vault-injectedResolved organization policy default-internal
Created identity boundary okta-sso
Attached roles viewer, editor, owner
Injected 2 runtime secrets
Deployment healthy
Built where your agents work
CursorClaude CodeCodexLemonCrowAny shellCI runners
One command, the whole handoff
The agent finishes the app.
acss finishes the infrastructure.
No ticket, bespoke pipeline, or second deployment surface. The same action that makes the tool live also makes it governable.
A
The tracker is implemented and tests pass. I can deploy it now.
$
acss deploy ./sprint-tracker↵- 01BuildPackaged and health-checkeddone
- 02IdentityConnected to company SSOdone
- 03AccessRoles scoped to groupsdone
- 04NetworkPrivate route createddone
- 05AuditEvents streaming to SIEMdone
Governance as a reviewable change
Every security decision is explicit and inspectable.
Every control attached by acss is explicit, inspectable, and versioned alongside the service.
1identity: okta-sso
2provisioning: scim
3session: company-managed
4public_signup: falseService inventory
Know every tool, owner, and boundary.
See what exists, who owns it, which agent built it, who can access it, where it runs, and whether it is live.
Service inventory
Know every tool, owner, and boundary.
See what exists, who owns it, which agent built it, who can access it, where it runs, and whether it is live.
Service
Owner
Built by
Access
Network
Status
sprint-trackertool · 18 runs
eng-platform
CLI agent
engineering
VPC private
● Live
support-triageagent · 94 runs
cx-systems
Claude Code
support-leads
EU region
● Live
invoice-reviewtool · 31 runs
finance-ops
Cursor
finance
VPC private
● Live
release-notesagent · 52 runs
devrel
Codex
company
Cloud private
● Paused
Run
Service
Agent
Initiated by
Policy
Result
Duration
run_01J7F2C2m ago · 8d31a7
sprint-tracker
CLI agent
p.koomen
✓ passed
● deployed
18.4s
run_01J7EZW17m ago · 43b0c9
support-triage
Claude Code
m.chen
✓ passed
● completed
42.1s
run_01J7EV338m ago · e98a12
invoice-review
Cursor
a.singh
! blocked
● stopped
6.8s
run_01J7ERA1h ago · c5174d
release-notes
Codex
r.jones
✓ passed
● paused
29.7s
Complete run lineage
✓ policy passed
run_01J7F2C · sprint-tracker
- 01Intent capturedp.koomen asked the CLI agent to deploy the engineering sprint tracker.
prompt sha256:7a8f…c12d - 02Source and agent identifiedCLI agent · workspace trusted · commit 8d31a7 · 7 files changed.
repo github/acme/sprint-tracker - 03Build evidence createdTests passed, dependency scan clean, image and SBOM generated.
image sha256:b941…98ae - 04Organization policy evaluatedOwner, SSO, group access, private network, secrets, and audit policy approved.
policy bundle org-default@v42 - 05Deployment recordedVersion 18 promoted to the private company runtime.
sprint-tracker.internal.acme.com - 06Runtime events linkedFirst access, agent actions, permission checks, and SIEM events attach to this run.
trace id tr_7f29c0
Agent runsLast 7 days
92 totalTop policy interventionsPrevented before runtime
- Public network requested5
- Owner missing3
- Unapproved secret scope2
- Data residency mismatch2
Organization
Global guardrails
Approved agents, identity providers, regions, data residency, retention, and default network posture.
- Agent allowlist
- SSO / SCIM
- Residency policy
- Audit retention
Service
Ownership and access
Every tool receives an accountable team, company identity, group-scoped roles, and a declared data boundary.
- Owner required
- Viewer / editor / owner
- Group grants
- Service identity
Runtime
Infrastructure boundary
Control where code runs, what it can reach, which credentials it receives, and how resources are constrained.
- Cloud / VPC / on-prem
- Private ingress
- Egress policy
- Runtime secrets
Every agent run
Traceable execution
Link each prompt or task to the agent identity, source changes, tool calls, tests, policy decisions, artifacts, and runtime outcome.
- Initiator + agent
- Prompt / task hash
- Commit + diff
- Policy verdict
- Artifact provenance
- Runtime events
Built for the gap after generation
Coding agents can create the software. They still need somewhere responsible to put it.
Agent-native
Invoked from a terminal, editor agent, CI job, or remote coding environment. No separate builder UI required.
Private by default
Internal tools are not public links. Exposure is a deliberate policy change, not the default result of publishing.
Governed from first deploy
Ownership, access, auditability, and runtime boundaries attach before the service becomes available.
Design partner access
Give every coding agent a safe place to ship.
We are onboarding teams already using coding agents alongside Okta, Azure AD, Google Workspace, or internal SSO.