Opaque decisions
Agent reasoning hides in prompt transcripts. There is no versioned process describing what an agent was allowed to attempt, or why it did what it did.
Agentwerke by Isartor AI
The governed lights-out
software factory
Agentwerke turns autonomous coding agents into an enterprise-grade production line. Every run walks a versioned BPMN workflow; every integration and tool call crosses a policy gate; sensitive work runs in a sandbox; humans hold the approval choke points — and each run leaves an audit-ready evidence pack behind. Self-hosted, on your infrastructure, with your model keys and your data boundary.
Manifesto
The governed lights-out factory
“Lights-out” manufacturing proved that a factory can keep running without people on the floor. Philip K. Dick's 1955 story Autofac warned what happens when automated production continues after meaningful human control has slipped away. Agentwerke takes the name in a different direction: agent plus Werke, the engineered works where software agents operate. The product thesis is not an autonomous factory beyond control. It is a professional software factory where agents plan, build, integrate, and deliver under enterprise governance.
AI agents can now plan, code, test, review, and open pull requests. Left alone, that becomes another opaque production system: fast, tireless, hard to interrogate, and too easy to trust because it looks useful. Agentwerke is the enterprise control room around them, where every job has a process model, every integration and tool call crosses a policy gate, every sandbox has a boundary, and every run leaves evidence behind.
The thesis The point is not to make agents harmless. The point is to make powerful automation inspectable, interruptible, and accountable.
-
01
Autonomy without blind trust
Agents can act, but never get direct access to credentials, networks, repositories, or deployment paths.
-
02
Workflow over vibes
Software delivery is modeled as versioned BPMN, not hidden in a prompt transcript.
-
03
Sandboxes by default
Agent work happens inside controlled Docker, OpenSandbox, or Kubernetes execution environments.
-
04
Humans at the right choke points
Approval gates, wait states, and policy outcomes are part of the process — not bolted on later.
-
05
Evidence as exhaust
Prompts, tool calls, policy decisions, costs, artifacts, and outcomes are captured into evidence packs.
-
06
Self-hosted by design
Run the factory on your infrastructure, with your model keys and your data boundary.
The problem
Agentic speed without control is a liability
AI agents can now plan, code, test, review, and open pull requests. Left unmanaged, that power becomes another opaque production system — fast, tireless, and hard to interrogate. In a regulated engineering org, the gaps show up fast.
Weak auditability
Merged code arrives with no defensible trail of prompts, tool calls, costs, and approvals — exactly what compliance and incident review need.
Uncontrolled tool access
Credentials, networks, repositories, and deployment paths sit one unguarded tool call away from an autonomous process.
Data exposure
Prompts and context flow to third-party model endpoints with no redaction boundary, residency control, or secret-handling discipline.
Inconsistent SDLC process
Every team wires agents differently. Handoffs between planning, build, review, and deployment stay manual and low-visibility.
No human choke points
High-risk steps merge without an explicit decision. Approval is bolted on after the fact instead of being part of the process.
The platform
The control plane around your agents
Agentwerke is not another coding agent. It is the governed factory floor the agents run on: a layered .NET control plane where every job has a process model, every tool call crosses a policy gate, every sandbox has a boundary, and every run leaves evidence.
BPMN workflow runtime
A bounded, Postgres-backed engine executes versioned BPMN. Approval gates and wait states are first-class nodes, not exceptions.
Agent orchestration
Service tasks dispatch to the agent layer, which assembles the profile, skill, run context, and tools, then drives the model loop.
Policy-enforced tool gateway
Every tool and connector call is brokered and evaluated before it runs. Decisions are allow, escalate, or reject — and recorded.
Policy engine
Data-driven rules with a draft → simulate → publish lifecycle and impact analysis. Every decision carries a purpose-confidence and risk score.
Sandboxed execution
Agent and tool steps run in isolated containers — Docker, OpenSandbox, or Kubernetes — selected per step by sandbox profile and network policy.
Human approvals
High-risk steps pause for an explicit decision, including interactive approve/reject from Slack. The decider is written into the audit trail.
Evidence packs
Each run emits a schema-versioned, tamper-evident record — prompts, tool calls, policy decisions, costs, approvals, and artifacts.
Enterprise integrations
GitHub and Jira intake, GitHub branches/PRs/reviews, CI/CD, Slack and Teams, MCP tools, and multiple model providers.
How a run flows
One run, end to end
A run moves through the nodes of a BPMN model. When it reaches an agent task, the orchestrator evaluates policy before the model receives work. Approval tasks pause for a human; wait states resume from external signals. The output is code plus the evidence of how it was produced.
Why Agentwerke
Coding agents optimize speed. Agentwerke optimizes governed delivery.
Same agents, same models — a different objective. Agentwerke trades a sliver of raw speed for delivery you can put in front of an auditor.
Ordinary AI coding agent
Agentwerke
Objective
Raw speed to code
Governed delivery you can defend
Output
Code
Code plus evidence, approvals, and traceability
Process
Defined inside a prompt
Versioned BPMN workflow
Tool access
Open and implicit
Policy-gated, permission-scoped, recorded
Execution
On the host, unbounded
Sandboxed with network policy
Humans
Reviewer after the fact
Approval gates inside the process
Deployment
Vendor cloud
Self-hosted, your keys, your data boundary
Enterprise & security
Built to run inside your boundary
Self-hosted by design: workflow definitions, runs, approvals, audit records, and run context stay in your PostgreSQL database; artifacts stay in your storage. Data leaves the boundary only through integrations and model providers you explicitly enable.
Self-hosted deployment
Run the full factory on your infrastructure via Docker Compose or Kubernetes / Helm.
OIDC / JWT SSO
Validate tokens from your identity provider — Microsoft Entra ID, Keycloak, and other OIDC issuers.
Role-based access control
Viewer, Operator, Approver, and Admin roles gate every product action and are written into the audit trail.
LDAP / AD group mapping
Map enterprise group IDs and external app-role names to Agentwerke roles through configurable claim mapping.
Data residency
Keep PostgreSQL, artifact storage, and model endpoints in EU or customer-dedicated regions to meet residency requirements.
PostgreSQL-backed state
Durable, event-sourced run state with a transactional outbox — runs advance, pause, and resume reliably.
Artifact storage
Store artifacts on the filesystem or in an S3 bucket and region you control.
Secret handling
Model and connector secrets are read from a secret store; the Settings API exposes only status and fingerprint, never raw values.
Docker / Kubernetes
Container-native runner images and a Helm chart for production; single-host compose for smaller footprints.
Audit-grade evidence
Every AI-generated artifact ships with its proof of work
GET /api/runs/{runId}/evidence-pack returns a
structured, schema-versioned record of the run — designed to be
tamper-evident, with the workflow's BPMN hash bound in for integrity.
It is the difference between “the agent wrote this” and “here is exactly
how, under which policy, and who approved it.”
- Promptsredacted in the persisted snapshot
- Model & tool callsusage, invocations, results
- Policy decisionsallow / escalate / reject, with rationale
- Sandbox executionsprofile and network policy
- Approvalsdecider and decision, timestamped
- Costsper-run token and USD accounting
- Artifactsoutputs produced by the run
- Outcomesaudit log + BPMN hash for integrity
Integrations
Fits the tools your delivery already runs on
Intake, source control, chat, CI/CD, and any MCP-compatible tool — brokered through the same policy gateway. Bring your own model provider.
Delivery & collaboration
Model providers
Selected per deployment; per-run cost and token budgets halt model calls once exceeded.
Bring autonomous agents into your SDLC without giving up control.
Governed autonomy, audit-grade evidence, and a self-hosted delivery control plane your security and compliance teams can stand behind.