When you have to decide if it is safe to let an agent act
Let agents act without letting them act alone.
Before you let an agent act on real state, prod, spend, or customer data, you want the blast radius: what it can touch, what stops it, and what you can read afterward. Who owns it when the agent gets it wrong. SynthWeave holds a consequential write as a proposal at the data layer, before it lands, server-enforced. Not a node someone remembered to place. A property of the platform.
And here is the limit, up front: it is one process with shared workers. Your data plane is separated by per-org row-level security in Postgres. Compute isolation between orgs is not something we claim today.
Enforcement, not a reminder
The gate is a property of the platform, not a node in a flow.
Other tools ship a gate you author into a graph or a step you design into a workflow. That works until the day someone building the next flow forgets to place it. SynthWeave holds the write server-side, at the data layer, before it lands. The human reviews a proposal, not a rollback of something that already happened.
The precise scope, because you will ask. The automatic halt covers edits to existing documents (snip_rewrite and snip_patch). Creating new documents and changing metadata are not gated yet, and it depends on auto-accept being off. Real code runs in an isolated sandbox. It is enforcement at the data layer, not a rule in a prompt.
Audit is the default, not a feature
You can read exactly what happened.
Every run is a record you can read: what the agent touched, where the halt landed, and what a human accepted. The blast radius is not a promise in a data sheet. It is the trace itself, and you can read it before you let anything act.
The honest frontier
What we can't do yet.
You are the seat that this matters to most, so we would rather you read it here than find it later.
- Org-scoped, not org-isolated. One process, shared workers. The data plane is separated by per-org row-level security; compute isolation between orgs is not something we claim.
- No SOC 2 or any certification, and no trust center. If your review eliminates on a questionnaire before the conversation, we are not the tool yet.
- No self-hosting and no data residency guarantee.
- No app store, and no third-party app execution.
- The workflow engine runs an ordered list of steps. No branching, no looping.
We do not have a certification, and we are not apologizing for the absence of one. When an objection lands here, the honest answer is that it is currently unanswerable, and we will say so.
See it act
Read the trace before you let it act.
Start free, read a run trace, and see where the halt lands. Then decide what you are willing to let an agent do.