The governed passage for agent work
One MCP URL per organization. Permissions per call. Credentials in custody. A verifiable record.
Governed channel
identity → policy · credential → record
Call: mcp__docs__read
Illustrative example with synthetic data
How it works
Every crossing passes the same five gates. The record below is the same one section 3 starts from.
1 / 5
The passage knows who calls: a person, an automation, or an agent with a key.
agent:analyst authenticated
Illustrative example with synthetic data
1 / 5
The passage knows who calls: a person, an automation, or an agent with a key.
agent:analyst authenticated
2 / 5
The policy answers one question: may this caller touch this tool, this way?
read allowed · write denied
3 / 5
The credential never reaches the agent. The passage holds it and uses it on the caller's behalf.
credential in custody, never exposed
4 / 5
The call crosses to the tool. A denied call never leaves the border.
mcp__docs__read executed
5 / 5
Arguments stay out of the record. The hash-chained receipt stays in.
receipt sealed · #a3f9…c21d
Proof of refusal
Pick a scenario. Both leave a record; only one reaches a tool.
Illustrative example with synthetic data
Want this boundary around your agents? Join the waitlist
Beyond the endpoint
Scheduled work and private interfaces cross the same channel, under the same policy.
Three steps, one graph: gather two sources, merge, notify. Each step crosses as its own call, with its own receipt.
Each step of the graph returns to the channel.
An automation is a graph of steps. A step never borrows the next step's permission: each one authenticates, each one is judged by policy, each one leaves a receipt.
A private interface inside the dashboard with one action: approve the weekly report. The action crosses the channel like any call.
Dashboard · private
—
A private App is an interface with a narrow permission. Pressing the button issues one call through the passage — identity, policy, credential, record — exactly like an agent's call.
Illustrative example with synthetic data
Architecture
Six parts, no magic. What the passage does not do is written down next to what it does.
1
Agent, automation, or App.
2
One MCP URL per organization.
3
Who calls, and with which key.
4
What this caller may touch.
5
Credentials in custody, calls placed.
6
The tool or API behind the border.
↩ On the way back: redaction, then the sealed record.
The code link appears here once the public repository is confirmed.
Questions
The launch is a waitlist for access. Deployment options will be announced to the list before general availability.
Each caller — person, automation, or agent with a key — authenticates at the edge. Every decision downstream names that identity.
No. Credentials stay in the broker's custody. The agent asks; the passage presents the credential upstream on its behalf.
Structure, not content: who called, which tool, the decision, and a hash-chained receipt. Arguments and prompts never cross into the UI or the record.
Interfaces inside the dashboard with narrow permissions. Each action they take crosses the same passage as an agent's call.
News about Daphnis availability. One email, nothing else required — no name, no phone, no company size.
Still interested? Join the waitlist
Waitlist