Agent-native automation platform

Run AI agents like production infrastructure.

StarColony is a durable, governed fabric for AI agents. Every LLM turn and every tool call runs as a replayable, budgeted, audited workflow step — and the guardrails live in the platform: allowlists, grant tokens, network policy, human approval. Never in the prompt.

Request early access Survey the architecture

ARCHITECTURE FINAL · FOUNDATION SLICE RUNNING · DESIGN PARTNERS ONBOARDING

  • Temporal durable execution
  • Rust control plane
  • AES-256-GCM payloads
  • Per-run grant tokens
  • Tenancy on every table
  • Hash-chained audit
The problem

Agents don’t fail like software.

Most teams run agents the way they’d never run a service: steered by prompts, holding broad credentials, losing state on restart, leaving no record of what they actually did.

FAULT 01

The lost run

A worker dies forty minutes into an investigation. The context was in process memory. Start over — and pay for every token again.

FAULT 02

The polite guardrail

“Please don’t delete anything important” is a steering suggestion, not a control. One injected instruction and the prompt is working for someone else.

FAULT 03

The standing credential

The agent holds an org-wide token in an environment variable — for every run, every tool, indefinitely. Compromise the worker, inherit the keys.

FAULT 04

The invisible action

Which tool did it call? With what arguments? Approved by whom? If the answer lives in stdout, the answer is gone.

Prompts are steering. They were never brakes. The brakes have to be built into the platform.

One fabric, two primitives

Agents and pipelines are peers.

Both dock on the same durable fabric. Agents reason and choose tools; pipelines pull, crawl, and normalize. Neither is a bolt-on to the other.

Docking bay A — Agents

The durable AgentLoop

One workflow type runs every agent. Each LLM turn and each tool call is a workflow activity:

  • replayable and resumable by construction
  • budgeted — turns, tool calls, and spend are capped per definition
  • tool intents checked against the grant in deterministic code
  • results land in the evidence store; state carries pointers, not payloads
Docking bay B — Pipelines

Any workflow, any language

The entire bring-your-own-worker contract is a shipping spec, not an SDK lock-in:

task_queue     byo-data-team
workflow_type  WarehouseFreshnessCheck
payload       JSON

Registered through the same public API as everything else. Any Temporal SDK language qualifies.

Durability

Kill the worker. Keep the run.

Because every step is recorded workflow history, an agent that loses its worker resumes from its exact last step — same run, same budget, nothing repeated.

The edges are durable too. Every webhook persists to an outbox and is acknowledged even when the fabric’s frontend is down — a redrive sweeper re-dispatches with backoff, so a vendor exhausting its retries never loses a signal. And deterministic run identities collapse webhook retry storms into exactly one run.

Governance

Every claim names its mechanism.

Nothing on this page is enforced by a system prompt. Each governed plane has an enforcement point you can audit — and most of them would hold even against a compromised worker.

  • Plane 01
    Tools

    A compromised worker cannot call ungranted tools.

    • deterministic allowlist gate
    • grant JWT · 15-min TTL · revocable
    • NetworkPolicy
    Enforcement: 3 LAYERS

  • Plane 02
    Models

    No code ever names a model — and sensitive data never routes through third-party model brokers.

    • job classes → gateway aliases
    • data classification pins routing
    • per-workload keys + budgets
    Enforcement: POLICY-PINNED

  • Plane 03
    Evidence

    Workflow history is not a plaintext store of your documents.

    • AES-256-GCM payload codec
    • pointers, not payloads
    • masked snippets · keyed fingerprints
    Enforcement: ENCRYPTED

  • Plane 04
    Sandbox

    A coding agent’s maximum authority is opening a pull request.

    • egress-locked ephemeral jobs
    • no push credentials inside
    • GitHub Rulesets as the ceiling
    Enforcement: EGRESS-LOCKED

  • Plane 05
    Humans

    Consequential actions wait for a human — and the requester can never approve their own.

    • Slack approval on the run
    • separation of duties
    • timeout → auto-deny · fail closed
    Enforcement: FAIL-CLOSED
The sandbox

Maximum authority: a pull request.

Coding agents run in ephemeral, egress-locked jobs. The capabilities you’d worry about aren’t switched off — they were never installed.

Push to main NOT INSTALLED

GitHub Rulesets require a PR and reviews; the app sits on no bypass list.

Hold credentials NOT INSTALLED

Publication tokens are minted outside the sandbox — per run, single-repo, 1-hour TTL.

Open egress NOT INSTALLED

Default-deny network. Two ducts: the model gateway, and a logging proxy path-scoped to the target repo.

Open pull request INSTALLED · LIVE

The one door. Plan → human approval → apply in a fresh sandbox → PR.

The infrastructure change lane is stricter still: the agent edits config only, the plan output is the reviewed artifact, and apply happens post-merge through your existing pipeline. The agent never holds cloud credentials.

Human-in-the-loop

The approval gate.

Consequential tools are gated on a human decision, delivered where your team already lives. The card shows the tool arguments verbatim — approval fatigue is fought with information, not volume.

Audit ledger — hash-chained · append-only

  • seq 41 · tool_call · github.create_pr · held for approval prev 9f3a…c2 → hash 62b1…8e
  • seq 42 · approval · approved · principal m.reyes prev 62b1…8e → hash a04d…71
  • seq 43 · artifact · PR #1847 linked · transcript stored prev a04d…71 → hash 3c9f…d5

The ledger is written by a role that can insert and never update or delete, and it exports nightly to write-once storage. A compromised component can stop writing history. It cannot rewrite it.

Engine / content split

Security is the first pack. Not the point.

The engine ships zero domain semantics. Whole problem domains arrive as content packs — versioned bundles of agent definitions, tool grants, connectors, and record types registered through the public API.

The engine

Permanent structure
  • Rust control plane — the only public HTTP surface
  • Durable execution fabric for agents and pipelines
  • Tool registry, grants, model policy, evidence store
  • Tenancy on every table from day one
  • Generic typed records — no domain vocabulary anywhere

Pack 01 — Security

Deletable by design
  • Cloud-finding triage → remediation pull requests
  • PII scanning across Drive, Notion, and Linear
  • SIEM investigations with approval-gated write-back
  • Slack-native triage and paging, approval-gated

Deleting the pack leaves a complete platform — and CI enforces it: a non-security workload must register, schedule, run, and be observable end-to-end with zero engine changes.

Site survey

What stands. What’s under construction.

StarColony is being built in the open with design partners, in phases, with exit criteria. Present tense on this page means the architecture; here is exactly where the build is.

Standing today — the foundation slice

  • Kubernetes dev cluster with the full stack under orchestration
  • Rust control plane — workloads registered and runs started via the public API
  • Durable Rust workers executing on the Temporal fabric
  • Model gateway deployed for job-class routing
  • Encrypted payload codec (AES-256-GCM) built and tested
  • Evidence object store and tenancy-first schema in place

Stated plainly

An agent with a granted egress channel can still misuse it within the gate’s bounds. Injection resistance is layered — templates, schema-bound notifications, scoped egress — and human approval on consequential tools is the backstop, not a formality.

Local sandboxes are weaker than production sandboxes. On a laptop cluster, isolation degrades — so it’s a flagged, alerting condition, and applying changes from a degraded sandbox requires an explicit override.

Parts of our toolchain are young. The Rust Temporal SDK is in public preview; we pin it exactly, keep workflow code orchestration-thin, and rehearse replay compatibility before any rollout.

Early access

Design partners wanted.

We’re onboarding a small cohort of teams who run Kubernetes, want agents doing real work — remediation, scanning, investigation, or something we haven’t imagined — and want the guardrails in the platform from day one.

Supply manifest · design partner
COHORTdesign partner · early access
RUNS ONyour Kubernetes · any cloud
WORKERSRust core · BYO any language
STAGEfoundation slice · phased build
Request early access

No invented logos, no fake metrics. A conversation about your workloads and our phases.

Autonomy, inside the law.