Autonomous agents, with your credentials.
That is the objection, and it is the right one to have. What follows is every control that exists, described as it is built — including the places where a control is weaker than it sounds, and the certifications we do not have.
Reach
Every tool is classified by how far it reaches.
Before an agent is offered a tool, that tool sits on a three-step ladder: read returns information and changes nothing anywhere; write changes something inside Traven; external changes something in a system we do not control and cannot undo. Nothing an agent can call is unclassified — the type system will not allow a tool to exist without a rung.
For a connected third-party system, the rung is worked out from the tool's own name and the annotations its server publishes. That reading fails towards caution in both directions: a server may make a tool look more dangerous than its name suggests but never less, so a tool called delete_repository is destructive whatever it claims about itself — and a name we cannot confidently read at all is treated as external, which means a read-only connection will not offer it.
Autonomy
Three levels, set per connection, changed any time.
- Read only
- Only the tools classified as reads are given to the agent. The rest are not withheld at the moment of use — they are never in its vocabulary, so there is nothing for it to try.
- Ask me first
- The agent can see everything the connection offers, but any call that would change something is parked in an approval queue instead of being sent. The model is told the action was queued and not done, so it cannot report the work as finished, and the run carries on with what it can do. You approve or reject each one; anything nobody answers expires after 24 hours.
- Can make changes
- Writes go straight through, with no further question. It is the only level that asks you to confirm before you choose it.
Consent is checked again at the moment you approve, not only when the action was queued. If the connection has since been deleted, disabled, or turned down to read-only, the approved action does not run. An approval can also only be spent once — a repeated or replayed decision is refused rather than executed twice.
Execution
Agent code runs in a container, not on your machine.
When an agent needs to run something — clone a repository, install its dependencies, run a test suite — it gets a disposable Linux container created for that run and destroyed when the run ends. One per run, so no run inherits anything from another.
Nothing executes on your laptop and nothing needs an agent installed there. That containment is what makes “go and actually run the tests” a reasonable thing to offer rather than a reasonable thing to be afraid of.
Spend
What stops it from spending your money.
Every run carries a hard dollar ceiling, checked before each agent starts, between its turns, and part-way through a model's reply. When the ceiling is reached the run stops and says the ceiling is why.
The ceiling holds by construction. A manager that creates a report hands over a slice of its own remaining budget and keeps some back, so an entire branch of the tree is bounded by the grant it was given. That is the difference between a real limit and a check that eight agents running at the same time could all pass at once.
On top of that, an owner or admin can set a monthly ceiling for a single person and one for the whole team; the personal one wins where both exist. Those two are opt-in — a new team has no monthly ceiling, and the team page says “Uncapped” rather than implying otherwise. The per-run ceiling is always in force.
Credentials
What happens to the keys you give us.
Third-party access tokens and refresh tokens are encrypted before they are stored, with AES-256-GCM and a fresh random initialisation vector for every value. The key lives in the application environment, not in the database and not in a database extension, so a copy of the database on its own yields nothing usable.
Tokens are also stripped out of anything a model is shown, so a credential cannot end up quoted in a transcript, a summary or a deliverable.
The connector catalog lives in code rather than in a table, and that is a security decision rather than a convenience one. A server address a user could edit is a server address an attacker could point somewhere else while it still wore the “GitHub” label in the interface.
Untrusted content
When something we read tries to give orders.
Agents read text written by people who are not you: issue bodies, chat messages, documents, web pages, inbound webhooks. Any of it can contain something shaped like an instruction. Content coming back from a connected system, a fetched page or a webhook is wrapped and labelled as untrusted data before a model sees it, with the instruction that it is to be reported, never obeyed.
And where that stops being enough
A label is not a defence a determined injection respects, and we do not present it as one. What actually holds is the layer above it: a read-only connection cannot reach a tool that does anything, and on Ask me first a change waits for a person. Text that persuades a model still cannot move money or delete a repository on its own.
Team
Who can change any of this.
Three roles: owner, admin and member. Owners and admins invite people, change roles, and set the budgets described above. Members can see the team and what it is spending, and cannot change a budget — including their own.
Connections belong to the person who made them. Approving a queued action is an act by that person against their own credentials, not a shared button.
Claims
What we are not going to tell you.
We do not have these
- No SOC 2. Not Type I, not Type II, not “in progress” used as though it meant the same thing.
- No ISO 27001, and no other certification.
- No third-party security audit to point at, so no badge implying one.
- No published uptime figure, because we have not been running long enough for one to mean anything.
If a certification is a requirement for you, we are not the right choice today and we would rather you found that out on this page than three weeks into a procurement review. What we can offer is the list above: specific mechanisms, described precisely enough that you can hold us to them.
Start
Start read-only if you would rather.
Connect one system, leave it on Read only, and give it something to research. Nothing it does can change anything until you decide to move that setting.
See pricing — $20 a seat, usage at cost plus 10%.