Team Nebula
Schedule a call
Inside our engagements· multi-tenant agent platform

One control path for every agent action.

NebOS is the harness our engineers deploy for people, agents, tools and company context. Every action passes the same checks, and anything consequential waits for a person.

Schedule a callTrust & governance

Not sold on its own · deployed and run by our engineers inside an engagement

NebOS · Governance
ApprovalsAccessAuditControls
Approval gate
Approve all
Account Steward · 3 proposalsProposed by agent:account-steward
Northwind Freight · stage → Proposal
crm_update_client · Signed scope call notes from Oct 30
RejectApprove
Northwind Freight · meeting recap
crm_add_note · Recap from the Oct 30 discovery call
RejectApprove
Priya Nair · replied to outreach
crm_add_contact_signal · Reply detected in the shared inbox
RejectApprove
Recent decisions
Qualify lead · Halvorsen LabsSucceeded
Send recap · internalRunning
Update stage · Arcadia HealthRejected
The approval gate, drawn from the NebOS console. Illustration, demo data.
1
Control path for every tool call
Fails closed
Tenant isolation in the database
0
Agents that can approve themselves
MCP
Any compliant client connects

The job

Agents can reach every tool. Nobody can see what they did.

AI agents could reach plenty of tools, but each connection brought its own permission model, its own log, and very little shared business context.

Agents wired tool by tool
  • A different permission model per integration
  • Logs scattered across vendors
  • No shared memory of the client or the deal
  • Stopping an agent means finding every key it holds
With NebOS
  • Every call runs the same checks in the same order
  • One audit trail of who asked, who decided, what ran
  • Agents read and write one company context
  • One kill switch halts every governed call and revokes the tenant's API keys

The control path

Five checks, in order, on every call.

The kill switch is checked first, so off means nothing runs. Writes that change a record come back as a proposal, and only a person can decide it.

  1. 01
    Kill switch
    Off means nothing runs
  2. 02
    Permission check
    Scoped to this agent and tool
  3. 03
    Tenant boundary
    Row-level, fails closed
  4. 04
    Human approval
    On consequential actions
  5. 05
    Audit trail
    Who asked, who decided, what ran
The control path NebOS runs before any tool executes. Diagram.

Approvals

An agent can propose. It cannot approve.

A governed write returns a proposal instead of running. It sits in the approval gate with who proposed it and why, and the decision is recorded next to it.

one governed write
agent:account-steward  crm_update_client
 
✓ kill switch        on
✓ permission         crm.write (scoped)
✓ tenant boundary    northwind-freight
■ approval required  consequential write
 
status  proposed     waiting on a person
 
x agent:account-steward  decide  refused
✓ human:j.ruiz           decide  approved
✓ handler ran · audit record written
One agent write, from call to decision. Illustration, demo data.

In an engagement

How NebOS arrives in your operation.

  1. 01

    Your tenant

    A boundary of its own, enforced in the database.

  2. 02

    Your connectors

    CRM, mail, docs and calendars, each scoped per agent.

  3. 03

    Your agents

    Each with its own permissions and its own kill switch state.

  4. 04

    Your approvers

    The people who decide what the agents propose.

Head to head

How it compares.

Pick a platform to see where NebOS differs. Each row is drawn from that product's own public positioning.

CompareNebOSLangGraph PlatformAgent runtime and orchestration
Built forOne control path for every agent in an organizationDevelopers building agents
Tenant isolationFail-closed, by defaultPer deployment
Kill switchHalts all governed calls and revokes keysStop a run
Human approval on consequential actionsInterrupt and resume hooks
Audit trailEvery governed action, readableTraces in LangSmith
Tool accessThrough MCP, least privilege per toolAny tool in code
Where it runsInside our engagementsTheir cloud or self-hosted

When LangGraph Platform is the better pick: Your own engineers are building and running the agents and want full control of the graph.

Competitor rows describe each product's own public positioning as of November 2026. Check their sites for current details.

The honest limit

Approval is only as good as the person reading it. NebOS puts every consequential action in front of a human with its reason attached, but it cannot judge whether that human read it. That is why we set up the approver list with you, not for you.

Start here

NebOS comes with an engagement, not a subscription. Bring a workflow you would never let an agent run unsupervised.