The eight questions every team asks before agents reach production.
The agentic platform: the one place where all your company’s agents run, any agent, any model, any runtime, under one set of permissions, approvals and audit. And because it is also a foundation, you can build your own runtime, harness and team shape on it. The AI decides what it wants to do. Xema decides what it may do.
The eight questions
You don’t have to bet on one.
Governance stays put.
Agents run on interchangeable runtimes. Run OpenCode, Claude Code, Codex, Copilot or your own SDK. Whichever one runs the agent, identity, permissions and audit are the same.
1Runtimes are plug-ins
The runtime is how an agent thinks and edits. It is not where the rules live.
2One identity, one set of permissions
An agent on one runtime holds the same grants as on any other. Nothing is configured twice.
3Change runtime, keep governance
Moving an agent to another runtime does not reopen the security review.
4Bring or build your own
Built an agent on your own SDK, or a runtime of your own? It runs under the same identity, permissions and audit as the rest.
Agents do the thinking.
The workflow owns the order.
A workflow puts deterministic steps around agent work. The order is written down, so it is the same every run.
1Agent steps
Plan, implement and review are steps. Each one is handed to an agent and returns a deliverable.
2Review loops
A review that finds problems sends the work back for another pass, until it is clean.
3Validation against a spec
A deliverable is checked against the spec before the next step sees it.
4Human decision gates
Where a decision matters, the run waits for a person. It resumes once.
5Schedules and matrix runs
Run a workflow every morning, or across many cases at once. Each run follows the same order.
6Notifications
The person who must decide is told, in the tools they already use. A run that finishes can tell its owner too.
7Agents that call agents
Agents hand work to each other over A2A, and the call is decided and audited like any other.
Every tool call
is a decision.
Every tool is a registered capability with a risk tier and an effect class: read, write or admin. Nothing an agent can call is unnamed.
1Grants for people and teams
A capability is held by a person or a team. The agent can never do more than the person it acts for.
2Every agent has an identity
An agent’s grant is intersected with its user’s. Whatever either one lacks, the agent lacks.
3No self-approval
A high-risk action needs an approval by someone else. Nobody approves their own request.
4Denials are explained
A refusal carries its reason and lands in the audit log.
5MCP through the gateway
MCP servers are reached through the gateway, never straight from the agent.
6Hooks on tool and model calls
Your organisation’s hooks see every tool call and every model call: data-loss prevention, prompt-injection checks, secret scanning. If a hook cannot answer, the call is refused.
Kubernetes. Your cloud or ours.
The org as code.
Xema runs on Kubernetes, in your cloud or ours. The whole organisation setup is Terraform, reviewed like any other change.
1Models and providers
Which models, which providers, and the keys they use.
2Grants, teams and environments
Who may do what, in which team, and where.
3Skills and agents
The agents you run and the skills they carry, versioned like the rest.
4Egress, per organisation
Decide which hosts each organisation’s agents may reach. Everything else is closed.
5Sign-in from your directory
Entra and Google directories supply people and teams, so grants follow the org chart you already keep.
Agents ask for a lane.
Never a model.
A lane is a kind of work: planner, coder, review, light. The organisation maps lanes to models in one strategy.
1One change swaps a model
Change the model behind a lane once, and every agent that uses it follows.
2Cheap lanes for cheap work
Release notes do not need the strongest model. Put them on a light lane.
3Bring your own keys
Use your own provider keys and your own providers. No lock-in to one model vendor.
4Retire a model with a successor
When a model is retired, the lane names the model that takes over. Agents keep working.
5Evals gate promotion
A new model or a changed agent reaches the organisation only after its evals pass.
6Spend ceilings
Set a limit per team or lane. A run that would cross it is stopped, not billed.
Every session
in its own sandbox.
Each agent session runs in an isolated sandbox. What happens inside is recorded, and you can stop it.
1Its own workspace
The agent works on its own copy. It does not touch anyone else’s.
2A full transcript
Every step of the session is kept, so it can be replayed.
3A kill switch
Stop a session at any moment, from the platform.
4VM-level isolation
For work that needs a harder wall, a session runs in its own virtual machine.
5Governed egress
A sandbox reaches only the hosts your organisation allows. A call to anywhere else is refused and recorded.
Evals are workflows.
Evidence is the default.
Run the same task across lanes and models, score it with your own tests, and repeat it on a schedule.
1A hash-chained audit log
Every decision and tool call is written to a chain you can re-derive.
2Replayable sessions
A session is a transcript. Open it and see what the agent did, in order.
3Traces and metrics
Traces and operational metrics go to the monitoring you already run, Prometheus included.
4SIEM export
Stream audit events to your SIEM, so the security team sees agents next to everything else.
5Evidence for auditors
Export the evidence an auditor asks for in one file: who held what, who approved, what was refused.
Plan, implement, review.
Then a person decides.
Plan, implement, review, validate deliverables, human gate, release. Each gate is a step you configure, not a convention people must remember.
1Run it as a team
A harness strategy sets the roles, the reviews and the gates, and which roles are people. Read about agent teams.
2Gates are steps
A gate is part of the workflow definition. It runs every time.
3Versioned packages
Agents, skills and workflows ship as signed, versioned packages. They are validated before they run.
4Draft, sandbox, org
A package moves from draft to sandbox to the organisation, one step at a time.
5A bill of materials for every agent
Each agent lists its models, tools, skills and data sources, so you can say exactly what is running.
See a delivery pipeline with its gates.
Follow a ticket from plan to release, and see where the workflow waits for a person. Or see everything else you can build on the same foundation.
At a glance
- five runtimes, one set of rules
- workflows own the order
- every tool call is a decision
- Kubernetes, org as Terraform
- lanes, not model names
- a sandbox for every session
- a hash-chained audit log
- gates you configure