Proviso: custom agents whose rules hold whatever runs them. Teams want agents that act on real systems, and two things stop them. Nobody can say afterwards who allowed an action. And the permission rules live inside one vendor's agent, so they disappear the day the team changes models. Proviso is a small platform where you create your own agents, one for each job, connect your own apps to each, and talk to them by typing or on a live voice call. An agent runs on Claude Code or on Codex, and you can switch between them in the middle of a conversation: it stays one agent with one memory. Whatever runs it, every action goes through one gateway. - Policy before the action. The agent's only tools are the gateway's; the engines' own shell, file and web tools are off. Each call is unpacked into single actions and checked against rules before anything runs: allow, deny, or ask the person. A call that needs approval is held open until the person answers. - Rules in plain words. You add a rule as a sentence. One about amounts or names becomes an exact test; one about meaning ("never promise a customer a delivery date") is read against each action by a small judging model that can only make things stricter, never grant permission. - Decisions that belong to the agent. A refund rejected while the agent runs on Claude Code is refused on Codex without asking, even though the two engines word the request differently: an action has one identity whichever engine makes it. - Identity. An agent is a versioned record with an owner. Connecting an app to it is the grant of authority, recorded with who gave it, and it can be taken back. Every action records the person, the agent and its version, the engine and model, and the connection used. - Approval by voice. On a call the agent asks aloud, and the spoken answer goes to a separate judge that returns yes, no or unclear. "Hmm, I'm not sure" is not a yes. The ledger keeps the words that were spoken. - An audit trail the agent can read. An append-only ledger records every step. Asked "why did we refund Acme?" in a new conversation, the agent looks up its own record and answers with who asked, who approved and when. The example we built it around is a billing support agent with Stripe and Slack connected. Told that a customer was charged twice, it reads Stripe without asking, then proposes a refund, a goodwill credit and a note to the team, and waits for each answer. A refund of 100.00 or more is blocked by a rule with nobody asked. Everything was built during the hackathon, by one person working with coding agents.
Team
