AGENTS THAT DO REAL WORK. SAFELY.
An agent that can read customer records, browse the web, and send email is three safe tools and the possibility for a breach when used in conjunction. Hessra knows what the agent has been exposed to and refuses the combination.
THE PROBLEM
Agents are useful in proportion to what they can touch, and dangerous in the same proportion. In the last few months the largest companies in the world have shipped agents that damaged their own systems and other companies' systems. Those companies have security teams, red teams, and budgets. If they can't keep an agent inside the lines, how does a team of ten ship an agent that touches patient data, ledgers, or production?
The usual answers are a system prompt asking the model to behave, a sandbox limiting where it runs, and an allowlist limiting which tools it can call. None of them govern what the agent can do with what it has already learned.
WHAT HESSRA DOES
CAPABILITIES, NOT CREDENTIALS
The agent holds no ambient authority. Each tool call carries a token naming exactly what it may touch and what it may do, attenuated from the person who delegated it and verified by the tool itself. There is no shared service account to steal and no permission the agent was never explicitly given.
INFORMATION FLOW CONTROL
Hessra labels what the agent has been exposed to: private data, untrusted input, external channels. As exposure grows, the set of allowed actions shrinks. An agent that has read untrusted content loses the ability to send what it knows anywhere. Dangerous combinations are blocked by construction, not caught by a classifier.
A CONTROL PLANE FOR SCALE
The runtime is secure on its own. The control plane is how you run a fleet: tool registries, both Hessra's and your own private ones, per-agent policy, and a record of every action authorized and every action refused.
WHO IT'S FOR
TEAMS BUILDING A PRODUCT ON AGENTS
Who need a runtime they can trust with real authority on day one.
TEAMS BUILDING INTERNAL AGENTS FOR SENSITIVE SYSTEMS
In healthcare, finance, operations, and infrastructure, where a wrong action is a breach or an outage.
WHY IT WORKS
Hessra is not a wrapper around OAuth or a central permission check with an agent-shaped UI. It is built from capability security and information flow control, formal models designed for exactly this situation: untrusted code holding delegated authority. Centralized authorization cannot keep up with a world where every agent spawns subagents and every tool call is a trust decision. Capabilities can.
The capability engine and token primitives underneath are open source. Rust, Apache-2.0. GitHub →
Ship the agent you're afraid to ship.
If you are building an agent that needs real authority over real systems, we want to talk.