PRESHaiPRESHai
A concrete corridor with three steel-framed glass checkpoints, a stream of cyan pixels passing through each in turn.

Identity, policy and evidenceacross every agent run.

How PRESHos identifies people and agents, decides what each may do, isolates the work and keeps the record. Written for the person reviewing it.

Talk about your AI projectRead the detail

Identity, policy and evidenceacross agent execution.

  1. Enterprise identity

    A white model gatehouse with a turnstile, figures waiting, and a pixel badge above.

    SSO and IdP integration

    • MFA support, directory sync
    • Active membership, session

  2. Authorization

    Tenant and membership binding
    User context

    Roles, ownership

    Agent identity

    Assigned roles

    RBAC and tool policy

    Object, field and record scopes

    A white model checkpoint with three lanes: one open, one with a barrier and a booth, one walled off.
    • Allow
    • Approval
    • Deny

  3. Runtime choice

    Three cubes drawn in cyan pixels beside a white model laptop on a desk.
    Cloud
    • Isolated session
    • microVMs
    Local
    • Enrolled Mac
    • User workspace

  4. Connected systems

    A white model gateway wall with pixel streams fanning out to a server rack, an office and a cloud.

    Configurable cloud egress

    • SSRF safeguards
    • Scoped access
    • MCP, APIs and AI models

Shared security services

  • White model storage drums under a dome of cyan pixels.

    Protected data

    • Encrypted storage
    • Private file access
    • Point-in-time recovery
  • A white model vault with its door ajar and cyan pixel keys inside.

    Secrets vault

    • Google Cloud Secret Manager
    • Scoped runtime grants
    • Server-side credentials
  • A white model ledger with a trail of cyan pixels ending in a check mark.

    Audit and approvals

    • Run and tool event traces
    • Human approval records
    • Actor, action, outcome

The detail,area by area.

What PRESHos enforces at each point of an agent run.

Enterprise identity
  • SSO and identity provider integration
  • MFA support
  • Directory sync
Authorization
  • Tenant and membership binding
  • Role-based access and tool policy
  • Object, field and record scopes
  • Each action is allowed, sent for approval or denied
Agent identity
  • A personal agent acts as its owner, with the owner's access
  • A team agent acts as itself, with its own assigned roles
  • An agent never has more access than its owner
Runtime
  • Cloud sessions run in isolated microVMs
  • Local sessions run on an enrolled Mac, in the user's workspace
Connected systems
  • Configurable cloud egress
  • SSRF safeguards
  • Scoped access to MCP servers, APIs and AI models
Protected data
  • Encrypted storage
  • Private file access
  • Point-in-time recovery
Secrets
  • Google Cloud Secret Manager
  • Scoped runtime grants
  • Server-side credentials
Audit and approvals
  • Run and tool event traces
  • Human approval records
  • Actor, action and outcome for each
A wall of steel safe deposit boxes with one door open and a stream of cyan pixels rising from the floor into it.

Secrets stayin the vault.

Credentials are held in Google Cloud Secret Manager and granted to a run only for the scope it needs. They stay on the server.

How data is handled

How it fitsyour environment.

  • Your identity provider

    SSO and identity provider integration, with MFA support and directory sync.

  • Runtime choice

    Cloud sessions run in isolated microVMs. Local sessions run on an enrolled Mac, in the user's workspace.

  • Your infrastructure

    For custom enterprise deployments, your data can be hosted in your own infrastructure.

Relatedreading.

More on Platform
The Tampa Riverwalk at night, with downtown towers on the right and a stream of cyan pixels following the railing.

Reviewing PRESHos?

Bring us your security questions. We will walk through identity, authorization, runtime and the record with your team.

Talk about your AI projectSee governance