Private infrastructure for AI agents
Every agent runs in sealed hardware, behind a gateway that holds its keys, decides where data may go, logs every call and stops it on command. The rules ship inside the proof, so your clients can check them.
We're building it now, for firms that handle client data: law, accounting, finance.
OUTLOOK_TOKEN added at the gateway
OUTLOOK_TOKEN may only go to graph.microsoft.com
on_violation: pause · owner notified
How an agent runs
Each agent gets its own sandbox inside a confidential VM. The sandbox has no network. Its only way out is the gateway next to it, in the same sealed hardware, so every request passes the same checks.
Your code, any framework, in a gVisor sandbox. It sees placeholders such as {{OUTLOOK_TOKEN}}, never the key itself.
The one door out. It runs your policy on every request before anything leaves the VM.
Starts and stops VMs, bills usage and shows you request counts and timing. It never sees your data or keys, and it can't make a VM run code you didn't sign.
Controls
We're building these into the gateway now.
The vault inserts each credential as the request leaves the gateway, and only for the hosts that key belongs to. A prompt-injected agent can't leak a key it never had.
sandbox holds {{OUTLOOK_TOKEN}} · gateway sends it only to graph.microsoft.com
Each agent lists the hosts it may reach. Everything else is refused, outbound email is off, and a platform blocklist stops known malware and phishing hosts.
default deny · per-agent allowlist · SMTP blocked
Every call is recorded: tool, host, allowed or blocked, size and timing. The full log is encrypted to your key and opened in your browser. We see counts and costs, nothing more.
signed records · encrypted to your key · exportable for audits
trigger it yourself, or by budget, rate limit or a spike in blocked calls
Policy
You write the policy next to your agent. It's signed into the release, so the attested VM can only run with exactly these rules.
A partner or a client's IT team can read in one page where data can go and what happens when an agent misbehaves.
Changing the allowlist means a new signed release, recorded in a public log. Nobody can loosen it quietly, including us.
Identity, network, data and key rules live in the same file instead of five dashboards.
agent: inbox-sorter
egress:
allow:
- graph.microsoft.com
- inference.tinfoil.sh # attested model
secrets:
OUTLOOK_TOKEN:
send_only_to: graph.microsoft.com
access:
sso: harlow-llp # SCIM-provisioned staff
approve_before_send: true
data:
region: us
retention:
activity_log: 90d
working_files: 7d
limits:
requests_per_minute: 120
daily_budget_usd: 5
on_violation: pause # or: revoke, stopSecurity as a platform
Other platforms enforce these rules on servers you have to trust. Here they run in attested hardware and show up in the proof.
| Area | What you set | How it's enforced |
|---|---|---|
| Identity | Single sign-on and SCIM provisioning for your staff; who may run or approve each agent. | Sign-in tokens are checked inside the enclave. Your users' keys stay on their devices. |
| Network | Allowed hosts per agent, per-key destinations, rate limits. | The gateway is the only way out of the sandbox. |
| Data | Retention per data type, region, approval before anything is sent. | Storage is encrypted per agent and deleted on schedule inside the VM. |
| Keys | Credentials for the services your agents use. | Held by a vault that only attested VMs can open, added at the boundary. |
| Evidence | Which reports you need for audits and client questionnaires. | Signed activity records and attestation reports, exported on demand. |
Proof
Attestation works today: your browser checks Tacy Chat's agent VM before sending anything. Public releases and signed activity records are being built.
The CPU signs a report of the exact VM image, agent and policy. Browsers and our verifier check it before sending anything.
compose 94a35d35…
Every release is built in public CI, signed, and recorded in a transparency log. Anyone can rebuild it and compare fingerprints.
sigstore · rekor
The gateway signs every record with a key that never leaves the enclave. You hold the only key that reads them.
encrypted to you · tamper-evident
Built on it
Private AI chat with web search and documents. Encrypted on your device, models in verified enclaves.
Sorts, summarizes and drafts in your Outlook or Gmail. Sends nothing without your approval.
Bring a container and a policy file. We'll run it sealed, with the controls above.
If your firm wants AI agents on client work and your clients want proof, we'd like to build the first ones with you.