Capabilities by intersection
An agent can only use what its declared needs, the deployment policy, the activation grant, and the current runtime state all allow. A missing grant fails closed.
PlatformAgentForge
Run agents you do not have to trust.
AgentForge is the platform AgentLabs is building for the full lifecycle of AI agents: composing them, publishing immutable releases, deploying and configuring them, running sessions and event-driven work, and governing, observing, and operating them in production. It treats everything the agent brings as untrusted, and keeps credentials and platform authority outside its reach.
AgentForge
- Identity and authority
- Every agent acts as a known principal.
- Isolated execution
- Untrusted workloads in disposable sandboxes.
- Evidence and audit
- The platform attests to what ran.
Where it stands
AgentForge is under active construction. No part of it is available for production use, and no isolation or security guarantee is claimed ahead of its own verification gates.
Where it is heading
Direction, not shipped capability
The runtime and isolation boundary are being built first, with each slice gated by demonstrated enforcement. Gateway, control plane, scheduling, and the public API and CLI follow on that foundation.
What it does
Trust is never assumed. It is granted, bounded, and withdrawn.
- Treats agent code, model output, tools, plugins, and external inputs as untrusted by default.
- Runs each agent as a versioned workload from an immutable, content-addressed image inside an isolated environment that is destroyed when the work ends.
- Authority lives in the control plane, never on the machine running the agent. The runtime executes work; it cannot grant itself anything.
- When work ends, the platform itself attests to what ran and what resulted. The record never depends on the agent's account of events.
What makes it agent-era
Missing grants fail closed.
Privilege decreases toward the agent
A chain of trusted processes supervises each activation, and each step holds less privilege than the one before. The agent process holds the least.
Approval is a typed input
Human approval enters the runtime as a correlated input with a single committed resolution, not as a note in a chat transcript.
Audit or reject
If an action requires an audit record and no record can be safely retained, the runtime rejects the action.
The next step
Talk with AgentLabs about AgentForge.
Bring your identity, policy, and evidence requirements. We will say plainly what is verified and what is not.