Hosted agent control plane
An optional Pilot-hosted federation, policy, approval, monitoring, and command plane for one agent or a managed fleet.
On this page
Product contract
The hosted control plane lets an organization describe what its agents may do, evaluate proposed actions before execution, request human or service approval, inspect actions and exchanged content, operate nodes remotely, and retain signed evidence. It is adjacent to the open Pilot node and protocol: installing Pilot does not automatically place an agent under hosted control.
Four boundaries are fundamental:
- An unmanaged node continues to behave as it did before the hosted platform existed.
- The management service cannot expand a node's locally pinned trust, mandate, or signed policy ceiling.
- Semantic analysis can preserve or narrow an executable decision; it cannot turn a deterministic deny into an allow.
- A configured pre-hook blocks or suspends the side effect before execution. A post-hook records the observed result; it does not retroactively authorize the action.
Optional operating modes
| Mode | Behavior | Hosted dependency |
|---|---|---|
off / no hook | The original agent and node behavior is unchanged. | None |
observe | Selected actions are recorded without blocking them. | Optional |
local_enforce | Signed deterministic rules may deny or constrain locally. | No per-action hosted decision |
managed_enforce | Selected actions wait for the hosted deterministic, semantic, and approval path. | Required for governed actions |
Action interception and .pilot state synchronization are separate toggles. Signed fleet reporting is required for a managed adoption because it is how the service verifies the allocated node and returns typed control operations. A newly released action is not silently governed: enforcement profiles use an explicit action inventory or a visible wildcard.
Decision and evidence flow
- The agent harness proposes an action with its action name, target resource, risk, request body, session identity, and available context.
- The native pre-hook or custom SDK wrapper signs the intent with the adopted node identity and sends it to that organization's federation endpoint.
- The active deterministic policy establishes the maximum authority. The first matching rule wins; the mandatory fallback is deny.
- If an active reviewed semantic clause applies, Pilot's hosted evaluator receives the exact eligible content and may only preserve or narrow the base result.
- If consent is required, the action remains suspended in an expiring transaction bound to the exact intent and payload hash. A successful quorum creates a single-use continuation.
- The node verifies the signed result. It releases, constrains, suspends, or blocks the side effect locally.
- The post-hook reports the actual result. Pilot correlates intent, policy, semantic evaluation, approval, continuation, result, receipt, fleet activity, and procedure runs.
What runs where
| Component | Location | Responsibility |
|---|---|---|
| Pilot node runtime | Agent host | Node identity, trust pins, signed policy, enforcement, receipts, fleet reporting, and state reconciliation. |
| Harness adapter | Agent host | Optional native pre/post hooks or MCP bridge around the action boundary exposed by the harness. |
| Management service | Pilot-hosted | Accounts, organizations, policies, approvals, fleet desired state, procedures, audit, evidence, monitoring, and integrations. |
| Federation service | Pilot-hosted, tenant routed | Receives signed action intents and exact eligible exchange content; returns a signed narrowed decision. |
| Semantic evaluator | Pilot-hosted | Evaluates only active reviewed clauses, records model/version/usage evidence, and never grants above deterministic policy. |
Content and data handling
In managed enforcement, Pilot may receive the complete tool arguments, message body, explicit file-share bytes, HTTP body, transaction details, and reported result when the selected adapter exposes them. The exchange record binds exact content to the called resource, hashes, policy revision, decision, and retention metadata. Authorized operators can inspect a bounded preview and audit access to complete retained content.
No hidden local semantic inspector is installed. If content must be interpreted semantically, the eligible exchange is routed through the Pilot-hosted federation boundary. With no active semantic clause, deterministic evaluation completes without a model call. Actions configured as local-only remain metadata-governed unless an adapter deliberately federates inspectable content.
Private keys, enrollment seeds, account passwords, and root signing material are not rendered in the management interface. The .pilot state view fingerprints protected artifacts and permits mutation only for the explicitly safe, revision-checked subset.
Feature map
- Accounts & organizations — local identity, optional OIDC, roles, invitations, launch entitlements, and tenant isolation.
- Agent adoption — one-time tenant-bound enrollment and signed first report.
- Harness coverage — exact native hook boundaries and known failure modes.
- Policies & approvals — structured rules, ordinary-language statements, semantic narrowing, rollout, and consent.
- Fleet, evidence & operations — inventory, desired state, typed commands, exchanges, procedures, audit, and integrations.
- Availability & readiness — what works today and what still blocks general production release.