Containment
Agents run in a locked room.
Each agent's work happens in an isolated, sandboxed environment with no open door to the internet. It reaches exactly two kinds of things: the documents you gave it, and the connections you explicitly made.
There's no "it wandered off and found something." An agent's reach is constructed, not discovered — you decide what's in the room before the work starts.
No open door.
Each agent works in an isolated sandbox. It reaches the documents you gave it and the connections you made — nothing else.
Control
Nothing changes without a decision.
Reading is free; changing is gated. Creating and editing documents, sending mail, writing to connected systems — each goes through an approval card unless you deliberately widened the agent's permission mode.
And every action, approved or automatic, leaves a visible tool-call trail in the chat. You can always see exactly what the agent did, in the order it did it.
Reading is free. Changing is gated.
Writes go through an approval card unless you widen the agent's permissions, and every action leaves a visible trail.
Access
Access is explicit, everywhere.
Workspaces are watertight — nothing crosses between them.
Within a workspace, you see your own agents, what was shared with you at the role you were given, and the read-only global agents. Search results obey the same boundaries — you can't find what you couldn't open.
Chats are private per person, even on shared agents. And connections act as the account that signed in: they're wielded only through that agent's approvals, and can't be borrowed by subscribers or lifted by recipients.
Watertight workspaces.
Nothing crosses between workspaces. Chats stay private per person, and search can't surface what you couldn't open.
Credentials
Your credentials stay yours.
Connecting a system like Xero or Outlook happens on the provider's own sign-in page. Agent Hero holds authorised access it can revoke — never your password.
Disconnect in-app or from the provider's security settings. Either one is immediate.
Never your password.
Sign-in happens on the provider's own page. Agent Hero holds revocable access, and you can disconnect from either side, immediately.
Spend
Money can't run away.
AI spend is prepaid. The hard ceiling is the balance your admin loaded, per-member limits are available on top, and every turn prints its exact cost.
The failure mode is a pause, never a bill.
A pause, never a bill.
AI spend is prepaid. The loaded balance is a hard ceiling, with per-member limits on top and the exact cost printed on every turn.
Data
Your data is your data.
Your documents and chats belong to your workspace. Model providers process turns to produce answers — they don't get your workspace, your document store, or anything an agent couldn't see in that turn. Deleting a document removes it from the workspace and its search index.
Compliance specifics — data residency, retention schedules, DPAs — vary by deployment. Ask your Agent Hero contact; for regulated industries there are deployment options designed for it.
Yours, end to end.
Documents and chats belong to your workspace. Model providers see a single turn, never the workspace, and deletion clears the search index too.
People change. The know-how stays.
