Kill switches at every level
Deny a tool version, a server, a connection, an agent, a workspace, or your whole organization in one action. Or a class: everything that moves money, everywhere, now.
Product · Oxagen
See which agent spent what,
and on whose behalf.
Oxagen prices every model call routed through it by token class and attributes it to the person, the agent, the run, the turn, and the step. Findings name the waste and who can fix it. Approval rules you wrote route matching requests to a person, and the record keeps every run frame by frame. Every charge traces back to the call that made it.
Claude Code, Codex, and any harness with a base URL. The agent never receives a connection credential.
- operatorada@acmestarted the run
- agentsupport-refundsasked for the call
- callstripe.create_refundamount $180 · input sha256:4c1f…9e02
- ruleMoves money above $100mandate finance-refunds · $1,340 of $2,000 used this month
Allow for this runDeny with a reason
Allowing it lets this one call through, bound to this agent, run, and expiry. The agent never receives the connection credential.
One mandate, four clauses
Every feature belongs to one clause of the mandate
Security sets access. FinOps sets the budget and the rules. Engineering sets the equipment. The platform keeps the record and enforces all four on every call.
Access
Don't hand your agents the keys.
Record
Any answer, walked back to the frame.
Budget and rules
Every dollar routed through Oxagen, reconciled to the cent.
Equipment
Give agents the business context their work requires.
Access
Don't hand your agents the keys
An agent under Oxagen holds an identity and a mandate. It does not hold a token to GitHub, a password to the database, or a standing grant to anything. When a task needs one of those, the agent asks. The request carries who started the task, which agent is asking, which tool it wants, and which data it would reach.
- A rule you wrote answers. The team that owns the system writes the rule. Reads of the public repo: allowed. A push to main: denied. A push to a release branch: routed to the release owner, who sees the request with the diff beside it and answers from the Access page. Allowed and denied requests settle inside the same call. Routed requests wait for the person, and the run waits with them.
- The connection credential never moves. It stays in Oxagen, encrypted under a key you own. Oxagen uses it on the agent's behalf and closes the connection when the action is done. The agent never receives it, though it still holds its own identity. The record shows every use: the request, the rule that answered it, and the person who signed it.
- Each connection has a named owner and a review date, and Oxagen audits every read. For each call Oxagen uses the narrowest credential the provider allows, such as a Stripe restricted key or an AWS credential scoped to one bucket, for the call plus a margin and never more than an hour. Revoke a connection and Oxagen stops using it at the agent's next request.
agentsupport-refundsidentity only
asks for s3.get_object on invoices
connectionOxagen vaultevery read audited
AWS credential · bucket invoices · 15 min · bound to c_81
tool servers3accepts Oxagen only
result goes back to the agent. The key does not.
rejected The agent's identity sent straight to the tool server, with no credential behind it.
Fleet
Run your agents as a fleet
Every agent your organization runs is on one page, whoever built it: Claude Code on a laptop, an Agent SDK service, a custom loop. Beside each one is the mandate it runs under, the requests it has open, what it has spent this month against its budget, and its last run with the record.
- Operate it from one chair. The operator answers routed requests, raises or lowers a budget, holds an agent, or stops it, from the same page. Each of those is a governed action with a row in the record: who did it, to which agent, under which rule.
- Spend is on the fleet page. The budget an agent runs under, the meter that prices each governed action, the rule that stops it, and the bill per agent, run, and person are beside the agent, not in a separate finance tool. The finance lead and the operator read the same rows.
- Steer every active run in a workspace with @agents. The steer lands as context on the agent's next model request, so no work is discarded, and the delivery report names the frame in each run where the model saw it. When the next step is too late, interrupt: the agent gets your text at once.
- Holding or stopping an agent works because Oxagen stops answering its requests, not because the agent cooperates. An irreversible call in flight is not abandoned, because nobody can un-send a payment, and the record says so.
runagentstatesaw the steer
run_01J9AB3Kci-fixerrunningframe 213
run_01JA2C7Msupport-refundspausedframe 88
run_01JB0Q4Ttriagerunningframe 41
run_01JC9W1Edocs-writerrunningframe 19
steer to @agents from ada@acme
Freeze deploys to production until 14:00.
delivered to 12 of 12each run names the frame that saw it
Budget and rules
Mandates for anything that matters
Moving money, destroying data, changing production, emailing customers, changing access: none of it rides on a role. A person you name sets bounded, expiring limits, and the rule reads them from the call itself.
- Tools are tagged by consequence. The rule denies a call carrying a tag before dispatch unless the tag is in the agent's mandate.
- Remaining authority is a ledger, so two concurrent calls cannot both fit under the same limit.
- Every consequential receipt records the external effect id and the mandate it drew on. The reconciler matches it against the payment processor's own statement, and an effect with no receipt is a critical exception.
set bydana@acme, finance lead. Two people sign a change.
Per call$180 of $250
This month$1,340 of $2,000
Calls today17 of 50
counterparties on the lista person above $100a person for anything destructive
consequence tagsmoves moneydestroys dataalters productioncommunicates externallychanges access
Access and record
Agent IAM: the definition in git, the identity in Oxagen
You would not deploy a service without a definition in source control. Every agent has one identity, one principal id that never changes, and one definition file in your repo. Change it through a pull request.
- Oxagen generates the Claude Code and Codex agent files from that one source in the same pull request, so every harness runs the same agent.
- Role-based access goes down to the tool version. An agent can never do more than the person it acts for, and subagents can only narrow.
- The harness's own shell and file tools sit in the same belt under the same rules. What it cannot call, it cannot see or search for.
in git
.oxagen/agents/support-refunds.md
- purpose
- Refund duplicate charges
- may call
- stripe.create_refund, zendesk.reply
- may never
- stripe.delete_customer
- ceiling
- moves money
- model tier
- light
- budget
- $0.50 per run
in Oxagen
Identity
- principal
- agt_4Q9K2M
- credentials
- held by Oxagen, never by the agent
- roles
- refunds-agent
- mandates
- finance-refunds
- acts for
- its operator, never more
Every run records the digest of the definition it ran from.
Record
The flight recorder
A run you cannot replay is a run you cannot explain. Every run is a hash-chained recording you can play back, fork, bisect, and export signed.
- Play a run at up to four times speed, with idle time compressed, so a forty-second tool call does not cost you forty seconds. Cost accumulates left to right.
- Fork starts a new run from any frame with the recorded tool results served as a cassette, so a failure becomes a test case and a question about a rule gets an answer.
- Bisect narrows two runs of the same task to the step where they split. At seal, the run gets a Merkle root and a signature your auditor can verify offline.
model calltool callrule decisionsealed
Budget and rules
Every dollar, every operator
Your provider bill says how much. It does not say who, for what, or whether it was worth it.
- The proxy prices every model call routed through it by token class, including cache reads, cache writes, and reasoning tokens, in micro-dollars, with the price entry it used.
- Every cost record hangs on a frame, and every frame knows its step, turn, run, agent, operator, and workspace, so attribution is arithmetic.
- The reconciler matches your ledger to provider usage exports by request id, then by key and day, then by invoice line. Budgets are enforced at the proxy before the call, not reported after.
matched onOxagenproviderresult
request req_8f2a$0.1400$0.1400matched
key ops · Sep 14$41.22$41.22matched
invoice line 6$612.08$612.08matched
invoice line 7$1,902.40$1,902.43exception $0.03
spend per run, agent ci-fixer, 8 weeks
$3.10 to $1.95
Equipment
Give agents the business context their work requires
Your agents do not know your business because nothing gave them a map. Oxagen builds one knowledge graph per organization, isolated in its own database, from GitHub, Linear, and Postgres.
- Every entity carries provenance back to its source record. Ask in plain English and see the Cypher query and the citations behind the answer.
- The ontology is inferred from your data, then proposed, reviewed, and activated as a versioned object that lives in git.
- Every run draws its context from this graph under a token budget, with a usage report on the frame.
asked in plain English
Who owns the refund policy?
team paymentsquery shown3 citations
The rest of the list
What else an agent control plane does
Simulate a rule before you switch it on
Rules are written in Cedar: deterministic, versioned, and tested. Before activation, Oxagen replays a rule against your recent real tool calls and reports what would change.
Prompt injection stops at the tool call
Tool output is data, never instruction. An argument derived from a document, a web page, or another agent's message is marked tainted, and taint on a write routes the request to a person.
An audit archive your auditor can verify
Full bodies, seven years, written once at seal time, encrypted under your own keys. Legal holds, crypto-shredding erasure, and an export bundle with a verifier script.
One accountable operator per run
Every run has exactly one human operator, even when a schedule or a webhook started it. Spend and progress roll up operator by operator.
It learned. You approved. It changed.
When an agent learns something, it proposes a context record. You review it as a pull request on your own repo. Nothing steers a run until it is merged.
Sixty seconds to wrapped
Wrap Claude Code or Codex with one click from a signed installer. The page flips to connected when the first frame arrives. Any model, any harness with a base URL.
Allowed by rule
A rule that allows is a decision someone wrote down, with conditions: an amount under a threshold, a counterparty on your list, business hours. When it allows a request, the receipt says allowed by rule, names the rule, and records that no person looked.
The short version
What the control plane holds
Oxagen sits beside your agents rather than inside them. It governs the runs, and you keep running the agents you chose.
- Access
- The agent asks, a rule you wrote answers: allowed, denied, or routed to a person. The credential stays in Oxagen. No model in the decision.
- Record
- Every run a chain of hash-linked frames, sealed with a signature, kept seven years in write-once storage by default.
- Budget and rules
- Priced per call by token class, rolled up to the operator, reconciled to the cent against provider statements.
- Equipment
- A knowledge graph from your own sources. Context records reviewed as pull requests.
- Fleet
- Every agent on one page, with its mandate, its open requests, its spend, and its last run.
- Harnesses
- Claude Code and Codex with one click, on macOS, Windows, and Linux. Any harness with a base URL setting.
- Models
- The Anthropic Messages API and the OpenAI Chat Completions and Responses APIs, so any vendor's model routes through.
- SDKs
- The OpenAI Agents SDK, the Claude Agent SDK, and custom agents in TypeScript, Python, or Go.
Get a demo
One denied request, one routed request, in twenty minutes
Bring a repo. Wrap one machine, run one task, watch one request denied and one routed to you, and read what it cost by operator, agent, run, turn, and step.
- →Live walkthrough on your use case, not a canned deck
- →Straight answers on rollout, pricing, and security review
- →You keep the run record