Agent runtime infrastructure for regulated production. Five pillars. Open by design.

cogward provides the governed runtime as a single deployable unit. The execution engine is part of the plane. Frameworks keep their native development model. The plane asserts five pillars required for regulated production — customer-owned, not managed by us.

See the architecture page for the technical design decisions: runtime/engine encapsulation model, adapter SDK contract, MCP gateway enforcement, and deployment topology. This page covers what the platform does, capability by capability — organised by the five pillars.

Staging

Availability model

One authorisation point for every tool call.

Process and network isolation per agent run.

Graduated isolation profiles from high-isolation (gVisor / Firecracker) to standard production. Profile-per-agent-class defined in the manifest. Bypass-resistant by design: network egress, agent identity, filesystem access, and tool API egress are all mediated simultaneously. All four must hold — an agent that can make a direct HTTP call or mount credentials from the environment has escaped the boundary.

Isolation violations recorded as security events in the evidence chain. Memory and session access governed at the retrieval API level — the agent cannot see or bypass the tenant filter through prompt construction.

Model calls are governed production dependencies.

The same enforcement model that governs tool calls governs model calls. Which model providers are permitted per tenant. Which models are permitted per deployment tier. Whether prompts can be sent to external model APIs — a data residency decision enforced at the boundary, not a product preference. Whether model versions are pinned across tenants or per-tenant. Model calls are governed production dependencies with the same audit trail as tool calls.

You cannot govern what you cannot enumerate.

Every agent in the estate is registered with a manifest: identity, owner, permissions, tool access, sandbox profile, resource budget, lifecycle state, and evidence requirements. One canonical, queryable record across every framework and team. No agent executes without being registered. No agent can claim permissions it was not registered with.

Registration is the gate — not a development workflow. Governed onboarding: package, validate, run pre-registration policy check, promote. Violations are blocked at registration, not discovered in production incidents.

Every agent authenticates as itself.Every action traces back to a user and an agent.

cogward treats agents as first-class identity principals — not users, not service accounts, not borrowed credentials. Built on OAuth 2.1. Every action is attributable to a specific non-human identity.

Stopping a runaway agent should not mean restarting everything.

Full lifecycle state machine: registered → staging → active → suspended → draining → cancelled → decommissioned. Every transition is operator-initiated, reason-recorded, and evidence-linked. Suspend a run. Cancel an agent. Kill a version. Drain a tenant. At whatever scope the incident requires — without touching what runs alongside it.

Lifecycle authority lives exclusively with the runtime. No framework, no capability component, no adapter can take it back. This is what makes the kill switch real rather than advisory.

Version rollback, graceful cancel, and drain are all durable execution primitives — not application-level state machines. Agent-to-agent governance: PII propagation boundaries, sub-agent permission inheritance (deny by default), delegation chain attribution. Later

If your deployment requirement is Tier B or Tier C, we are actively seeking design partners whose on-premise and air-gapped security requirements will harden the Tier B and Tier C deployment models. Talk to us before Phase 2 ships — design partners have direct input into the deployment architecture. Book a design-partner briefing →

Version governance for the full agent package.

A prompt change can alter agent behaviour as much as a code change. A model version change can improve one task and regress another. Version governance applies to the full agent package — code, prompts, tool definitions, model choice, model parameters, and policy configuration — not just source code.

Limits enforced before consumption — not discovered in the invoice.

Two components. Two audiences. Never combined.

Two artifacts. Two audiences. Same plane.

The events journal answers engineering questions. The audit ledger answers compliance questions. These are different artifacts for different audiences — produced by the same plane, serving different purposes.

Per-customer behavioural intelligence.No cross-tenant data sharing.

The plane is where identity, declared purpose, lifecycle context, policy record, and outcome data are recorded together. That combination produces a class of intelligence — drift detection, fleet patterns, goal achievement attribution — that no standalone monitoring tool, managed cloud runtime, or execution engine can replicate.

The human interface to the governed estate.

Every capability above is queryable, controllable, and observable from the Control Center — and from the full REST + event stream API surface. Build your own dashboards without loss of fidelity.