THE AGENT YOU CAN POINT AT PRODUCTION
Are you (rightfully) afraid to give your agent access to production? Hessra is an agent with fine-grained control over everything it can do. It starts with a broad set of tools, and that set narrows as it touches sensitive things.
Read a .env, lose access to email. Search an untrusted site, lose database writes. Deterministic guardrails that actually work.
THE USEFUL AGENT IS THE DANGEROUS AGENT (NO LONGER)
AI agents are useful because they have broad access and can handle the minutiae of stitching diverse systems together on the fly. That's also what makes them dangerous.
An agent is most useful when it can read esoteric documentation on the internet, act on your purpose-built systems, and tell somebody about it. Those same three things are the lethal trifecta, and they're how an agent gets talked into doing something bad.
Hessra lets you decide exactly what an agent can do, and in what combinations. Deterministically.
Prompt guardrails are theater. Take security into your own hands.
HOW IT HOLDS
NO TOKEN, NO EXECUTION
The model is untrusted code. Every call needs a capability minted for that exact action, right then. No authority carries over between calls. Denial isn't a rule that fires, it's a capability that never existed.
EXPOSURE ONLY ACCUMULATES
Tools carry labels. Fetch a page, pick up <untrusted input>. Read a secret, pick up <credentials>. Labels stick for the rest of the session, and further capabilities can be denied issuance based on those labels. The trifecta isn't detected, it's unreachable.
TOOLS VERIFY FOR THEMSELVES
A capability is bound to one tool. That tool checks it against a public key on its own, with no callback to any service. Lift a token from one tool and it's worthless at the next.
No general-purpose shell tool (outside a sandbox). Not now, not later. A general-purpose shell has no meaningful label and no bounded authority, which would make every guarantee above a suggestion.
WHAT YOU POINT IT AT
PRODUCTION SYSTEMS
Databases, cloud APIs, deploy paths, customer records. Off limits today because access is all or nothing. Here it's one operation on one object, and it's gone the moment the session touches something it shouldn't.
SECRETS THAT STAY PUT
Configure access per project. This project's agent reads this project's credentials. The same agent run anywhere else can't see them at all. And the moment it reads them, everything that could send them out is gone.
TOOLS YOU DIDN'T WRITE
Third party tools, integrations nobody audited, whatever a teammate dropped in. New tools land where the running agent can't see them. Load one and it stays provisional: it reads and computes, it can't exfiltrate, until you bless it.
THE TOOLS IT ASKS FOR
Hit a wall and the agent logs what it wanted instead of improvising. Read the log, scaffold the tool, drop it in. The gaps are your roadmap.
GET STARTED
TRY IT
One binary, a local root authority with its own keys, a policy file you can read in a sitting. Nothing phones home. Not public yet: tell us what you'd point it at and we'll send you a build.
The capability engine and token primitives underneath are already open source. Rust, Apache-2.0. GitHub →
DESIGN PARTNER
Putting an agent somewhere that scares you? We want the specifics. Early partners shape the policy vocabulary and the tool model.
Schedule a call →The LLM can ask for anything but can only do what you want. Let your coding agents code and let Hessra handle your sensitive systems.
Request access or schedule a call.