Flow
Availability and production readiness
What is live, what has been proved, and what still prevents a general production launch.
Verdict as of 8 August 2026. The hosted management deployment is online and its central enforcement path has been validated with real adopted agents. It is not production-grade as a public multi-tenant SaaS. It should be described as a production-hosted pre-release or design-partner environment, not generally available production service.
On this page
Current live status
| Capability | Status | Meaning |
|---|---|---|
| Management login | Live | The HTTPS login page is reachable and existing accounts can authenticate. |
| Public account signup | Not deployed | /v1/auth/signup returns signup_unavailable; new unrelated organizations cannot self-register. |
| Organization availability | Single preconfigured tenant | The live service currently serves the Pilot demonstration organization. |
| Managed node adoption | Live for the configured tenant | Short-lived one-time enrollment, verified delegated identity, bootstrap policy, and signed first report work. |
| Policy and semantic denial | Validated | A real Gemini-driven adopted agent was denied before executing a prohibited command; the expected filesystem side effect was absent. |
| Policy, approval, fleet, state, audit UI | Validated pre-release | Primary CRUD/lifecycle paths and 31 management pages have passed production-host UI sweeps. |
| Harness adapters | Mixed by harness | Several native paths are verified; partial and fail-open connectors remain explicitly labelled. |
| Plans and payments | Disabled by product decision | Public launch has one common entitlement, no checkout, no upgrade UI, and no customer charging. Usage remains measured for cost control. |
| Public multi-tenant platform | Not deployed | The SaaS provisioner, pooled runtime, account subdomains, and workspace controller are implemented/tested locally but not installed in the hosted GCP environment. |
What has been proved
- HTTPS management health, invitation-oriented login, tenant-scoped browser access, and cross-tenant query rejection.
- One-time managed adoption with server-assigned identity, signed trust and policy verification, secure local attachment, and fresh signed check-in.
- Structured policy creation, review, activation, semantic-clause evaluation, signed denial, post-hook evidence, and deletion/retirement paths.
- A real agent model proposed a prohibited
process.executeaction; Pilot denied it and the intended file was not created. - Fleet detail, desired state, commands, acknowledgements, safe
.pilotstate create/read/history/delete, monitoring, traffic, approvals, audit, investigations, integrations, and readiness pages. - Tenant-attributed evaluator usage and idempotent usage-ledger behavior in local full-stack and Kubernetes acceptance environments.
- Version-pinned adapter packaging and regression coverage, including compatibility for the removed legacy heartbeat hook command.
These proofs establish that the core security concept works. They do not establish the operational, organizational, and provider controls required for a generally available SaaS.
Actual public SaaS blockers
There are seven launch gates. Plans and Stripe are deliberately disabled and are not an eighth gate.
- Signup and provisioning: deploy and prove the full email verification, workspace reservation, owner creation, exact account subdomain, first session, adoption, retry, rollback, and cleanup journey without operator intervention.
- Tenant isolation: add a database-enforced boundary such as PostgreSQL RLS with mandatory tenant context or separate credentials/schema, then prove host routing, secrets, workers, caches, exports, logs, metrics, and backups cannot cross organizations.
- GCP KMS and storage integration: exercise native Cloud KMS signing/content-key wrapping and native Cloud Storage conditional writes, locked retention, legal hold, rotation, restore, outage, and cross-tenant denial through workload identity.
- Quotas and abuse controls: enforce distributed signup defenses plus hard node, request, event, content, storage, retention, queue, and semantic-spend ceilings, noisy-neighbor isolation, reservation cleanup, and operator response.
- Organization lifecycle: prove audited rename, owner transfer, suspension/resume, export, deletion, legal hold, node and credential revocation, usage closure, subdomain cleanup, retry, and partial-failure recovery.
- Load and disaster-recovery evidence: retain the declared workload envelope, latency/error/saturation and soak results, backup/PITR and object restore, key recovery, failover, provider outage, rolling upgrade, rollback, and measured RPO/RTO.
- Security assurance: complete independent penetration and architecture review, close findings, approve the pooled-tenancy, hosted-content/LLM, hook-bypass, privileged-support, supply-chain, recovery, and abuse threat models, and retain exact-release security evidence.
What production-grade means here
A service being deployed on a production hostname is not enough. General production readiness requires all of the following:
- new account to isolated tenant to real-agent denial works without operator intervention;
- cross-tenant reads, writes, host routing, secrets, usage, and backups fail closed under adversarial tests;
- every marketed harness claim is version-pinned and has allowed, denied, approval, timeout, and bypass evidence;
- provider credentials, keys, content, logs, evidence, and backups have reviewed retention and recovery controls;
- quota and usage-metering failures cannot expand authority or create unbounded model or infrastructure spend;
- documented SLOs, support, incident response, vulnerability handling, deployment rollback, and change management are staffed and exercised.
Where it is appropriate today
| Use case | Recommendation |
|---|---|
| Internal demonstration with the existing tenant | Yes. The live environment and permanent proof agents support this use. |
| Supervised design-partner evaluation | Yes, with a written scope, connector boundary, data/retention agreement, and operational owner. |
| Single-organization production pilot | Conditional. Perform organization-specific threat modelling, capacity tests, backup/restore, key custody, and incident readiness first. |
| Open public self-service SaaS | No. Signup, provisioning, multi-tenant hardening, planless cost controls, and cloud platform gates remain. |
| Regulated or safety-critical autonomous production | No general approval. It requires independent assurance, exact harness certification, retention/legal review, and customer-specific controls. |
Status discipline. This page records a dated deployment assessment, not a permanent guarantee. Reassess it after every authority, adapter, cloud, identity, evaluator, entitlement, or quota release.