What it is worth
A ledger, not a pitch. What an agent can do to your systems when nothing checks it, what that costs, the hours around it, and the work your agents can take on once they are safe to run.
What an agent can do when nothing checks it
An agent that acts on your systems is probabilistic, and your systems are not. These are the ways it goes wrong, each one from a real failure shape, and none of them has a ceiling: the damage is however many times it happened before someone noticed.
A retry after silence
The rollout that ran twice
The deploy tool times out after the rollout started. The agent sees no answer and tries again. Two rollouts race in production, and the incident starts before anyone is paged.
With ctrl: an outcome nobody saw is ambiguous, never failed. No retry until a person resolves it. Nothing runs twice on a guess.
A drifted approval
The yes that ran something else
A person approves a rollout of twelve pods. Before it runs the agent changes the image, the region or the count. The approval still says yes, so the new action runs under it.
With ctrl: the yes is for one exact action, bound to its hash and the state it was given in. Anything different is refused, and the approver is told.
A bulk change
Three hundred and forty records, gone
A CRM agent asked to "clean up stale leads" deletes 340 records in one call. A support connector asked to "let customers know" mails three hundred people. Both are one tool call away.
With ctrl: counts are the rule: a handful goes through, a bulk change waits for the owner, and an action with no rule does not run.
The permission change
The role that became admin
An agent fixing a failing deploy attaches AdministratorAccess to the deploy role. It works. Now every agent using that role has it, and nobody wrote that down.
With ctrl: privilege changes wait for the security approver, two of two, and the agent is never told where the line is.
The instruction in the data
Text that tells the agent what to do
The agent reads tickets, mail and documents to decide what to do. A line in any of them that reads like an instruction is one, to a model that cannot tell the difference.
With ctrl: the agent can be told anything and still cannot act outside your rules. What it read is never an instruction to the boundary.
The quiet agent
The one that stopped reporting
An agent that goes stale for three hours, then touches three systems it never touched before, is either a new workflow or a compromise. Without a record, nobody can tell which.
With ctrl: every attempt is a receipt, the gap is a signal, and the on-call lead can freeze the agent with one recorded action.
None of these is a bug in the agent. They are what a model does with tools and no boundary. ctrl is the boundary, and the ledger below is what it is worth.
What you save: three lines on the ledger
1. Losses
The wrong action
One bulk delete is a restore from backup and a day of engineering. One wrong rollout to production is an incident with a timeline. One send to three hundred people is an apology. Count how many a month, and what each costs to undo.
With ctrl: Waiting for a person where you said so, blocked where no rule allows it, never run twice. The wrong action does not run.
2. Hours
Approving and chasing
Every approval that lives in a new tool costs the approver a context switch, a login and a search for what the agent actually asked. Ten minutes is a fair guess. Multiply by approvals a month, by the approver's hour.
With ctrl: a card with the exact action on it, where the approver already is, Slack, Teams or their assistant. One click. About a minute.
3. Hours
Proving what happened
When a reviewer, an auditor or a customer asks what the agent did in March, the answer without a record is a week of logs and screenshots. Count reviews a year, by the days each takes.
With ctrl: every attempt, refused ones included, is a receipt you export. The answer is a file.
What your agents can take on
Saving is half of it. The other half is the work an agent can do end to end once every action is checked, the sensitive ones wait for a person, and there is a receipt either way. Each line below is work a person does today because nobody could let the agent do it safely.
Support
Tickets closed by the agent
A support agent that can update the ticket, change the order and refund under the band closes it itself. The person only sees the cases above the line, as one card, one click. The customer gets an answer in the same minute they asked.
Measure it: tickets closed without a handoff, time to resolution, and the waiting-then-approved rate, which tells you when a rule can loosen.
Releases
Deploys the agent runs
A release agent rolls out to staging on its own and to production with one approval from the release approver, in Slack. Rollbacks and restarts inside the budget run without anyone. The on-call person stops being the deploy button.
Measure it: deploys a week, minutes from merge to production, and approver minutes per deploy.
Data and operations
Bulk work under a count
A CRM or ops agent cleans records, merges duplicates and sends the routine mail under the counts you set. Above the count, or to more people than you allowed, it waits. Work that used to be a spreadsheet and an afternoon runs in the background.
Measure it: records handled by the agent, sends that went out on time, and hours of routine work moved off people.
Loosen the rules as the receipts earn it
Start from "observe everything" and read a week of what would have waited. Enforce one rule, production changes. Then widen: a higher count, a second agent, a bigger budget. Every widening moves work from people to agents, with the receipts that show it was right to.
An example, not a promise
Of 48,210 requests in a week across a workspace's agents, 812 waited for a person and 471 were blocked. The other 46,900 ran with nobody in the loop, each one checked and recorded. That is the week's work the agents did on their own, and the 812 are the only ones anyone had to look at.
What you never pay for
- Never metered
- approvers, viewers, agents, blocked actions.
- Never disabled
- enforcement. It runs on your side in every plan; at the cap ingestion pauses and your kernel keeps deciding.
- Every plan
- portable receipts in open JSON, export any time.