Saphan Studio is the control plane that makes that question answerable — for every change, on the record.
Your fleet works in your team’s language — the record answers the auditor in English. ไทย العربية Polski
Solo preview — next week
Saphan Studio for one developer, one workstation, free. Leave your email and you get the download link the day it ships — nothing else.
Send me the link →Team & Enterprise follow by end of September. Self-hosted: code and record never leave your machine.
What Saphan Studio holds for the enterprise
Governance → Every consequential decision is a human act on the record — silence is never consent, and refusals are data.
Security → Agents are treated as untrusted even when they are not malicious: confined runs, egress by named policy only.
Cost → Every run is quoted before it starts and booked next to the decision that approved it.
Enterprise → Control plane, record and identity stay on your infrastructure, with audit export from day one.
Controls → What is in place today, control by control — one row each: what it does, what it refuses, what the record holds.
Compliance → The evidence your existing ISMS requires — designed to map onto ISO 27001, ISO/IEC 42001, SOC 2, NIST AI RMF and the EU AI Act.
Product features
Bench → What your own hardware can actually serve — measured on your machine, not assumed from a model card.
MCP server → The record answers questions where you already chat: fleet state, gates awaiting you, spend by any axis — read-only, behind standard OAuth, with every access logged.
Discovery → A legacy system nobody fully understands, returned as an evidence-cited, signed understanding — knowing, not changing. Proven in engagements; now being re-seated on Saphan Protocol.
Governed runtimes · working today
Saphan governs the work around the runtime: admission, isolated identity, dispatch, confinement, cost, evidence, review and the human act. Changing the model or CLI does not create a second operating system.
Claude Code, OpenAI Codex, Qwen Code and Factory Droid run as named, seat-isolated backends under the same streams, gates and ledger.
The built-in tool-calling loop drives local models behind OpenAI-compatible endpoints, including Ollama and vLLM, without putting a vendor CLI on the critical path.
Compilers, test runners, linters and formatters are first-class recorded actors at zero model cost — governed work, not an unobserved shell escape.
Agents and toolchains can run in digest-pinned OCI images with a read-only root, non-root user, bounded mounts and runtime limits. The exact image is probed on the exact machine before dispatch; unsupported confinement refuses before spawn.
Human approval reaches the Git forge
Saphan binds the human merge decision to the exact pull-request head, carries that authority to the forge, and learns that the merge happened by observing the repository — never by trusting a successful API response.
The gate records the human actor, decision and PR head SHA. A new push makes that authority stale instead of silently extending it to different code.
A required saphan/gate status and branch protection stop an ungated merge on the forge itself; Saphan does not rely on the UI behaving politely.
The forge creates the merge commit with Saphan’s attribution trailers. The record advances to merged only after that commit is fetched and verified.
The API contract and its negative controls have been exercised on real GitHub and Gitea 1.26.4 repositories. The complete saphan merge --via pr product path is in active implementation; additional forge adapters are not presented as delivered.
Start alone. Keep the same control plane as the fleet grows.
Solo
Local engine, web console, CLI and editor workflow without a central server. The open door into disciplined agent work, not a trial that expires.
Team
Saphan-managed identity and data-free mobile notification signalling; your fleet, code and operational record stay on your infrastructure.
saphan-oauth and identity lifecycleEnterprise
Self-hosted organizational control, machine identity, policy, confinement and evidence export for regulated delivery.
saphan-oauth or any admitted local IdPDocumentation · implemented state only
Saphan Docs is written against existing code and verified product behavior. It covers deployment, configuration, security, governance, audit, and operations. No roadmap claims. No promises.
Open Saphan Docs ↗Saphan Studio is where you run AI agent fleets: briefs out, evidence-bearing returns in, gate decisions from your editor. You read results, not transcripts.
Work passes only with evidence attached and a human decision recorded. An approval without proof is unrepresentable — by construction, not by convention.
Everything above lands as plain files in your git — the operating memory of the work, built to flow into the audit tooling your organization already runs.
Not a feature list. The floor an enterprise gets today, one row per control — what it does, and what it leaves in the record for the person who was not there.
| Control | What is in place | What the record holds |
|---|---|---|
| Signed governance record | Actors, delegations, machines, seats and capabilities in one Ed25519-signed, append-only log. Every human-readable registry is a projection of it — regenerable, never a source. | The whole governance history, verifiable by a third party holding only the root public key — without trusting the machine that produced it. |
| Human gates, no exceptions | No auto-accept, no auto-merge, no timeout-as-consent anywhere in the product. A gate decision has no default value and is refused out of order. The engine transports; it never judges. | One gate row per decision: the actor, the decision from a closed vocabulary, the time. “Merged” is never declared — only observed from a real merge commit. |
| Tamper-evident decisions | Each acceptance is a keyed, verified tuple, re-checked at merge. Edit any field afterwards and the verification breaks. | The tuple and the result of its check at merge. |
| Suggestion ≠ decision | A consultation — AI or human — is recorded as judgment; the decision is the human’s own act; an override of the suggestion is itself recorded. | Distinct recommendation and decision rows per gate — not only what was decided, but what was recommended and by whom. |
| Machine identity by certificate | No registration endpoint, no join token. A machine is admitted by an explicit owner act with certificate binding; the control plane connects outward only, and runners hold no credential to it. | The admission act in the signed log; the certificate chain. |
| Delegated, bounded authority | Root-signed delegations with scope, work streams and a validity window. Expiry is a ceiling, never a trigger; retiring an actor takes effect immediately, regardless of any unexpired grant. | The delegation, signature over every field — who granted what to whom, until when. |
| Ratified standing law | The documents that govern how work is done are root-signed into a serial-numbered manifest. Any document verifies back to the root; an agent works under law it can be shown to have received. | The manifest, and each run’s record of which law was injected — with its hash. |
| OS-level run confinement, local | Deny-by-default write policy from the operating system’s own sandbox — Seatbelt on macOS, Bubblewrap on Linux — composed for each run before the agent starts. A missing sandbox facility refuses the run instead of degrading it. | The run record names the tool that confined it and the directories that stayed writable — a claim your team can reproduce. |
| OS-level run confinement, remote | Kernel-enforced (Landlock) confinement for SSH-dispatched runs. A machine’s confinement capability is measured before work is routed there; a machine not measured, or measured incapable, refuses the run. | The measured capability on the machine’s signed row; the run record naming what enforced. |
| Outbound access is a list | A run that declares an egress policy reaches the network only through a door that policy governs: a destination is admitted only if the policy admits both host and port, and the default admits nothing. A host that cannot be cut refuses the run rather than starting it open. Opt-in per dispatch in this release — there is no fleet-wide default yet, and we say so. | The compiled policy’s digest on the run’s row — which list governed this run. Per-connection judgements are not yet recorded; that is a stated limit of this release, not of the design. |
| No lateral agent channels | Agents coordinate only through recorded surfaces — orders, channel files in the stream’s own worktree ingested into the record, gates, an insert-only mailbox for the owner’s directives. No agent-to-agent messaging exists in the product. | “Who told whom what, when” is a query, not an interview — the coordination history of a stream, replayable from the record. |
| Refusals as data | Every refusal — engine, authorization, schema, policy — is a recorded, zero-cost row with a named class. Denial causes are logged, never returned over the wire. | The refusal ledger: the controls firing, not merely existing. |
| Monitoring — a Prometheus target | The serving daemon exposes GET /metrics in the standard Prometheus text format: runs by status and backend, refusals by class, gate decisions by gate and decision, store schema version. Label values are class names only — never stream names, paths or actor names. |
Refusals as a first-class metric — on this architecture a refusal is a security signal, not noise. Scraped by the Prometheus you already run; nothing to install. |
| Secrets never propagate | No subsystem stores or transmits a secret value — variable names and paths only, enforced in the type system. Key files are custody-checked before their contents are ever read. | Configuration by name. No value in any record, log or export. |
| OAuth 2.1 on the management surface | Bearer-gated. Team authenticates through the Saphan-operated saphan-oauth SaaS. Enterprise runs saphan-oauth locally or admits any customer IdP through a human-gated issuer trust list. Scope classes, tenant row-level slices, fail-closed by default. |
An audit-grade access log on every transport — honest status codes for wrapped refusals, no values or query strings ever logged. |
| Cost governance | Per-run quote and hard cap set before dispatch; capacity checked before the run starts; billing classes on seats. Actuals and drift land next to the evidence, not on a separate invoice. | The cost ledger, per stream and per gate — “what did this change cost” gets the same one-line answer as “who approved it”. |
| Supply-chain pinning | Agent binaries are delivered with a digest computed on the receiving machine, and identity is re-resolved where they execute. | Per run: binary digest, version, configuration hash, the standing law injected and its hash. |
| Your record store | A PostgreSQL record store on infrastructure you control, configured by name, credentials by variable name only. Code, run evidence and the operational record do not transit Saphan infrastructure. Team sends identity to Saphan-operated OAuth; Enterprise keeps identity local. Both can use mobile notification signalling carrying only an opaque gate id and badge count. | Your database, plus plain files in your git. Readable without our tooling. |
| Conformance, not assertion | End-to-end scenarios run against the real binary: gate discipline, dispatch locking, injection resistance, misrouted instructions, the OAuth flow, bearer gating, projection parity. | The conformance results, reproducible on your deployment. |
Fail-closed is the house style: an unrecognized configuration value, a missing sandbox, an ambiguous bind address — each refuses with a named class rather than falling back to a weaker posture. Where a control does not yet enforce, the documentation says so in as many words, and the roadmap names it.
How these rows map onto ISO 27001, ISO/IEC 42001, SOC 2, NIST AI RMF and the EU AI Act →
Governance is the guarantee. This is the daily work.
Work starts as an order: a self-contained brief with scope, constraints, and a proof standard. The engine dispatches it to your agents — no context lost in a chat window.
Agents come back with evidence-bearing returns — claims with proof attached. You read results and analyze diffs, not transcripts. The difference is a workday.
The fleet projection lives in VS Code: what is running, what awaits you, one command per decision. Gate a merge without leaving the file you were reading.
Every project carries its bridge: orders, decisions, findings — the operating memory of the work, as plain files in your git. Studio ships it, and your codebase gets one on day one. The method has a home before the first agent runs.
And this is what the files themselves look like — not screenshots of a promise, the actual shape of the work:
# ORDER — payments-refactor · wave 1 From: master · To: one executor · Stream: payments-refactor Worktree: worktrees/payments-refactor · Base: main @ 4f21c09 Protocol: saphan-protocol v1.0 · pinned in PROTOCOL_BASELINE.md ## Context — read first The payments module calls three providers (stripe, adyen, in-house ledger) directly from checkout code. Retries are ad hoc; a network blip on 06-24 double-charged three orders (postmortem PM-12). ADR-0007 (attached below) ratified one provider interface at STOP-1. This stream implements it. Nothing here asks you to design — the design decisions are made and recorded; your job is the build. ## Scope IN: a. PaymentProvider interface exactly per ADR-0007 §Decision — the Charge/Refund signatures are frozen there; do not redesign them. b. Three adapters: stripe, adyen, ledger. Existing behavior is preserved; parity proven call-for-call against recorded fixtures in tests/fixtures/providers/. c. Retries with idempotency keys (key = order_id + attempt window), stored in pending_payments — migration 0042, up AND down. d. Wire pin W-2: the public /payments API is FROZEN. Golden tests in tests/golden/payments_test.go must pass untouched — if a golden blocks you, STOP and report; never edit a golden. OUT (recorded — do not touch): checkout UI · refund flows (wave 2) · provider timeout policy (carry-forward on ADR-0007). ## Proof standard build green · full suite, counts as passed-of-total with skipped named · migration 0042 proven up+down on a schema copy, row counts pre/post · adapter parity: fixture diff empty · goldens untouched (git diff --stat on tests/golden = empty) · diff summary per file ## Stops STOP-1 already passed (ADR-0007). STOP-2: full return per template before merge. Merge is human-only, from the gate. ## If blocked Write the blocker under "Open questions" in the return, flag the stream, stop. Guessing past ambiguity is a protocol violation, not initiative.
Self-contained down to the frozen signatures: context, contracts, wire pins, a blocked-path instruction. If the agent has to guess, the brief was the defect — so nothing is left to guess.
# RETURN — payments-refactor · STOP-2 Executor: agent-7 · Commits: 6 (head a3f9e12) · Base: main @ 4f21c09 ## Claims, with evidence 1. PaymentProvider extracted; 3 providers behind one interface. → diff: 14 files (+612 −208) · golden tests untouched, green 2. Retries are idempotent under duplicate delivery. → TestRetryIdempotency: 200 duplicate deliveries, 1 charge 3. Migration proven both ways on a copy of the production schema. → up 1.2s / down 0.9s · row counts identical pre and post ## Open questions for the gate Provider timeout is 30s, inherited. Keep or tighten? Out of scope — flagged, untouched. ## Not done Refund flows: out of scope per order (recorded — wave 2).
Every claim travels with its proof. You read this in minutes — not a two-hour transcript.
# ADR-0007 — one PaymentProvider interface; providers are adapters Status: accepted · Date: 2026-06-30 · Actor: marcin · Gate: STOP-1 ## Context Three providers are called directly from checkout code. Each has its own retry style and error mapping; the test surface triples; adding or swapping a provider means surgery on callers. Incident 06-24: a timeout retry double-charged three orders (postmortem PM-12). ## Decision One interface, signatures frozen: Charge(ctx, Order, IdempotencyKey) → (Receipt, error) Refund(ctx, ReceiptRef, Amount) → (Refund, error) Providers become adapters behind it. Error taxonomy unified as retryable / terminal / unknown — the mapping is owned by each adapter and may not leak provider-specific errors upward. ## Consequences + one contract to test; parity provable against recorded fixtures + retries live in one place, above the adapters — idempotency enforced at a single seam, not three − adapters gain a lint rule: no provider error types cross the seam − migration 0042 required for idempotency-key storage ## Considered and passed Per-provider services — triples the test surface, scatters retry logic. Feature flags per provider — hides the seam from the record. ## Carry-forward Timeout inherited at 30s. Decide at wave 2 — trigger: refund flows.
Context with the incident that forced it, frozen signatures, consequences with their minuses, roads not taken with reasons. The brief above cites it — decisions are load-bearing, not decorative.
# Finding 4.2 — a number without a definition is not evidence Seen: a return claimed "tests: 124 passed" while 9 were skipped. The count was true and the claim was false. Rule: every number in a return carries its definition — passed of total, skipped named and justified. Applied: same cycle. All return templates updated; the gate now asks for the definition when a bare number appears.
A failure becomes a rule in the same cycle it was found. The protocol is case law, not a manifesto.
# The sandbox — how the pieces talk you — the operator │ briefs out · gates · reads returns ▼ editor / CLI (VS Code panel · saphan) │ ▼ saphan engine — self-hosted │ dispatch · fleet projection · refusals ▼ worktrees — one isolated sandbox per stream ├─ agent-3 payments-refactor running, wave 1 ├─ agent-7 atrisk-push stop-2 — awaiting you └─ agent-12 notification-svc merged, observed │ ▼ the bridge — plain files in your git orders · returns · ADRs · findings · gate log │ ▼ main — merge is human-only The protocol is the language every arrow speaks. The record is what every arrow leaves behind.
Agents run isolated in worktrees; the engine speaks protocol in both directions; every hop leaves a file. Nothing meaningful happens off the record.
The fleet projection in your editor: pick a stream, read the evidence, gate it — without leaving the file you were in.
$ saphan fleet show [awaiting-human] payments-refactor · stop-2 — evidence attached → run: saphan gate payments-refactor --gate stop2 --actor you
An agent finished its work and attached the proof. Nothing merges — the engine hands you, by name, the exact decision to make.
$ saphan gate payments-refactor --gate stop2 --actor marcin [refused] evidence incomplete — claims without proof cannot pass nothing advanced · the gate holds · nothing was merged
The refusal is the product. A gate that cannot say no is a rubber stamp.
$ saphan gate payments-refactor --gate stop2 --actor marcin [recorded] stop-2 approved · actor: marcin · 2026-07-14 09:12 +07 evidence: build green · 124 tests passed · diff 6 files · bundle sha256:9f2c…
Who, on what evidence, allowed it — answered in one line, forever.
$ saphan fleet show [running] atrisk-push · wave B in progress [awaiting-human] payments-refactor · stop-2 — evidence attached [merged] notification-service · observed on main
Many agents, one projection — and every state tells you whose move it is.
The engine never merges. It makes your decision recordable — and refusable.
The gate is a steering wheel, not a brake. The pause is not there to slow the fleet — it is the cheapest place left to change its direction. Three things the loop buys you, and one honest admission about turning it off.
Requirements change mid-flight. Caught at the gate, a changed requirement costs you one turned stream — not a week of swarm output in the bin. The gate is where the cheap turns happen, before the wrong direction compounds across the fleet.
“Explain this before I approve it.” The operator catches up with the system instead of signing blind — and the return’s whole job is to make that take minutes, not an afternoon. You approve with your eyes open, or you don’t approve.
“Why this way, and not the other?” is answered by documents — an ADR, the options considered and passed — not by anyone’s memory of a call made weeks ago. The reasoning is on the record before the question is asked.
The escape hatch, honestly
$ saphan gate payments-refactor --gate stop2 --actor auto-approver [recorded] stop-2 approved · actor: auto-approver · 2026-07-14 09:12 +07
Want to run the swarm with no human? Put a model in --actor and it will approve everything, forever. Nothing breaks. The record simply shows, per decision, that a machine signed every yes — and the difference between oversight and rubber-stamping becomes a queryable fact instead of a debate. We don’t forbid autopilot approval; we make it signed.
A human in the loop is the default here, not the law. What the loop guarantees is not that a person decided — it’s that the record can always say who did.
A fifty-engineer company does not have a frontier-model budget for work a script can do. The routing rule is simple: the cheapest worker that can still meet the proof standard.
An iOS build, a test suite, artifact packaging — these are commands, not conversations. Under the protocol they are executors like any other: dispatched by order, returning evidence, leaving the same record. Zero tokens spent on work a toolchain does better.
Self-hosted models behind the same boundary contract take the repetitive work: pattern migrations, summaries, scaffolding. Your metal, your data, your electricity bill — not a per-token invoice.
Claude, Codex, whichever you contract — reserved by policy for the work that deserves them: design, hard debugging, review. The policy is a file you write and version, not a default nobody chose.
The record knows which worker served every stream — attribution is a contract field, not a guess. Spend belongs beside the proof, per stream, per gate: “what did this change cost” deserves the same one-line answer as “who approved it”.
You already pay twice: engineers drive agents from CLI consoles on seat subscriptions, while pipelines burn metered tokens over the API — and the credits leak where nobody attributes them. Saphan puts both behind the same boundary: the same order in, the same evidence back, the same record — whether the executor is an interactive CLI session or a headless API call. Spend stops being a mystery split across two invoices.
The routing plane runs in our own stack today — one policy, from a local model server to frontier APIs, with CLI-driven agents working under Saphan right now. The headless/API lane is designed into the same contract; the cost surface is being finished with design partners — the attribution seam already sits in the contract.
Routing decides where a class of work belongs. Bench is how you find out what your own machine can take, so that decision rests on measurement instead of assumption. The gap between the two is not small, and it is not knowable in advance.
$ saphan-verdict [verdict] class-120b — 120.99 GiB addressable · hot + large fit co-resident → note: glm-4.5-air rejected — dominated by gpt-oss-120b on this class [critical] addressable memory is 63.3 of 125.5 GiB installed — raise the ceiling
The free step installs nothing and calls nothing. It reports GPU-addressable memory rather than installed RAM, because on the reference box those differed by half the machine — and every fit decision follows the smaller number.
Four models measured on one 128 GB node: GLM-4.5-Air, the flagship you would have picked, turned out 2.1× slower on both prompt processing and token generation than gpt-oss-120b — and 10 GiB heavier. Neither model card says so, because neither model card is about your machine.
Read the Bench brief — the measurements, and what they cost to learn →
Agent frameworks — LangGraph, CrewAI, in-house fleets — decide how agents work together.
AI-governance suites watch models, data, and policy from above.
Between them — where agent output becomes a change a human is accountable for — there is no incumbent. Saphan is that layer: above the frameworks, orthogonal to the suites. Swap the agent stack; the authority plane stays.
The boundary contract is small on purpose: an executor receives an order and returns evidence. Anything that can do those two things can work under Saphan.
CLI-driven coding agents and deterministic commands — that is how Saphan builds itself, every day, in production. No hypothetical: the fleet that ships this product works behind this exact contract.
Receive a self-contained order. Do the work in an isolated worktree. Return claims with proof. That is the whole interface — no SDK to embed, no framework rewrite: an adapter translates at the boundary and your stack stays your stack.
LangGraph, CrewAI, Microsoft Agent Framework, A2A — the adapter surface is specified; individual adapters are built with design partners, in the order partners actually need them. We would rather ship one adapter a partner runs than four logos on a slide.
Agent frameworks are having a fashion moment; your governance history should not churn with them. Adopt one, swap it, run two side by side — orders, gates, and the record stay identical, because they never belonged to the framework in the first place.
The method is not locked inside the tool. Saphan Protocol is the written discipline the engine enforces — orders, gates, evidence standards, decision records — versioned, human-readable, and hardened daily against our own fleets.
Machines execute it; auditors and engineers can simply read it. Protocol v1.0 publishes with the release.
Saphan is Thai for bridge — สะพาน. I build this in Hua Hin, Thailand, and the mark on this page is the Rama VIII bridge in Bangkok: a single pylon on one bank, holding the whole deck on cables you can count. I liked that honesty. Nothing hidden inside the structure — every line of force is visible, and you can trace exactly what holds what. That is the whole product, drawn in steel: work crosses, nothing falls silently, and you can always see what carries the load.
There is also an older reason. Every system I have run in decades of infrastructure eventually failed at the same place — not in the code, but in the crossing: the moment work moved from one side to another and nobody could later say who let it through, or why. Agents did not create that problem; they multiplied it past what human memory can absorb. So the tool is named after the thing that was always missing. Not a wall, not a gate for its own sake — a bridge that remembers every crossing.
The protocol and engine are running in production on our own projects — the system built and governs itself.
Public release is staged: protocol v1.0, engine, and audit pack ship together.
We are selecting 2–3 design partners (teams of 50–500 engineers with real compliance obligations).
The mechanism behind the record is the subject of a U.S. patent application — patent pending.
Poland — IP Partner, Warsaw. IP Partner represents Saphan in Poland: the first conversation in Polish, deployment on your own infrastructure, and a local team for organizations bringing AI agents into regulated engineering. Contact Łukasz Bederski, MBA, Founder — ippartner.pl · LinkedIn.
Representing Saphan in your market? hello@saphan.ai
Agent output is outrunning your review. Pull requests pile up, review slides into theater — and now your enterprise clients and auditors ask who supervises what the agents change. “A senior looked at it” answers neither problem.
A pilot team working the method daily: briefs out, evidence-bearing returns in, gate decisions from the editor — and your codebase carries its bridge from day one, so the discipline has a home before the first agent runs.
The audit dividend, for free: because every change already carries evidence and a recorded decision, the security-questionnaire answer becomes a document you attach, not a paragraph you improvise.
A claim your sales team can make to your clients, with receipts: “our AI fleets run under an auditable authority layer.” You sell trust; this is trust with a record.
One team, one repo. The founder does the deployment — first gates on your real work in week one. Self-hosted on infrastructure you control: Saphan introduces no new place your code goes. One hour a week. No license fee for the entire design phase. Walk away any time and keep everything below.
The record is plain files in your git — readable without our tooling, forever. The protocol publishes openly at v1.0: the discipline your team learned does not die with a vendor. The deployment you self-host keeps running. This is the opposite of lock-in, by construction.
Your edge cases become protocol rules (abstracted, never your internals), your friction sets the roadmap, and the Team tier — org-wide gates, shared projection, audit views — takes the shape of your organization, because you are in the room. Founding terms in writing before any public price list exists.
Design partner inquiries
Contact us — hello@saphan.ai