Security

Control access. Isolate execution. Keep evidence.

Agent work can cross repositories, data, tools, and external systems. Latchbox makes the boundaries explicit before execution starts.

Security model

Controls follow the workflow, not one temporary machine.

The control plane keeps state, policy, and evidence outside the environment where an agent executes.

Declare identity, permissions, network reach, and credentials for each step.

Keep code and tools inside an isolated runtime with budgets, timeouts, and policies.

Preserve the record after the environment ends so results remain inspectable.

Control layers

Issue access for the step that needs it, within the scope and time defined by policy.

Run work in an explicit environment boundary with declared network, file, and resource permissions.

Pause before sensitive actions so a person can approve, reject, edit, or redirect the workflow.

Inspect tool calls, changes, costs, errors, and decisions. Pause, cancel, retry, replay, or reassign work.

Keep inputs, versions, activity, tests, approvals, errors, outputs, and artifacts outside the sandbox.

Use Latchbox-hosted execution or, with Enterprise, a VPC, customer cloud, or external runtime.

A risk boundary

Policies and human gates define when a workflow can continue automatically and when it must stop for a decision.

01Read repositoryautomatic · scoped

02Change codeisolated · checkpointed

03External writehuman approval required

Deployment options

Self-serve

Start with hosted remote environments and bring your own model keys with no surcharge.

Enterprise

Use private networking, IP allowlists, customer-managed keys, a VPC, customer cloud, or external runtime.

Identity and evidence

Add SAML SSO, SCIM, roles, policies, audit export, and custom proof retention.

Early access

Tell us about the controls and execution model your team needs.