Branch protection, for every agent action.

You build and run your own agents. OwnCharter puts a fail-closed gate in front of every action they take, at runtime, and the gate is not writable by the thing it gates. Governed primitives built to be inspected and self-hosted, not a black box.

Your permission system is a prompt

You built the stack everyone builds. Git as the undo button, which works until the agent touches what version control does not cover: the prod database, the credentials, the network. Permission prompts, which work until the fatigue wins and YOLO mode goes on inside a container that is supposed to catch whatever falls. A hand-rolled allowlist, which holds until a sub-agent spawns past it or the agent edits its own settings file. And a tracing dashboard that is honest about what it is: the story of the damage, after the damage.

Every layer in that stack can be modified or escaped from inside the session it is supposed to constrain. A prompt can be fatigued out of. A config file can be touched by the process it binds. A sandbox shrinks the blast radius, but inside its walls it is default-allow. A trace of the disaster is not a gate in front of it. Prevention, not detection.

The gate is not writable by the thing it gates

OwnCharter puts one chokepoint in front of every tool call, and it fails closed: unverified, unresolved, or errored means denied before execution. No self-grant, ever. An agent cannot expand its own authority, and it cannot rewrite the gate that binds it. Only the operator grants capability. You already trust this shape: branch protection made "no direct push to main" a structural fact instead of a policy memo. This is the same rule, extended to every action your agents take, checked at runtime rather than merge time.

Intent outlives platforms

A gateway solves which model answers; it says nothing about what the agent may do, and it does not free your workflows either. OwnCharter separates what you want done from the tools that do it. You build against an intent layer: update the CRM record, issue the refund, reconcile the invoice. The tool behind each intent is replaceable, and so is the model: run the one that fits the job, swap it when a better one ships. Move from one vendor to another and your workflows do not notice. Leaving is a supported operation, and no renewal ever holds your intent hostage.

Proof you can check yourself

No claims on faith. The proof is ordered the way you rank it, not the way a marketing page does.

• Read it, run it. Built to be inspected and self-hosted, with no black box between you and the claim.
• Watch the deny. The verifier above refuses in front of you, and it is honest about being a simulation of the real invariant. A check that cannot fail is not a witness; the deny is the demonstration.
• Check the artifacts yourself. Signed packs you verify against your own pinned root. A hash-chained record you can walk entry by entry; tamper with it and the chain breaks where you can see it.
• Watch it get built. The build is public: what shipped, what broke, what got fixed. Roadmap stated as roadmap, heading for early alpha.

What you will not find: badges, analyst quotes, or certifications standing in for evidence.

What you get, and the ask

• A fail-closed gate in front of every tool call: unsigned, unverified, or unresolved means denied
• No self-grant, structural: only you grant capability, and the agent can never widen the gate it runs behind
• Signed capability packs verified against a pinned root you own
• A hash-chained permanent record: authorized before, recorded after
• An intent layer your workflows are written against, abstracted from every vendor and model
• An exit that is a feature, not a fight

These are the governed primitives, and they are being built in the open, heading for early alpha. Early access means getting them while they are still taking shape, and having a say in the shape. Request access and pick "Build and run my own agents". The path is already named for you.

Request early access