The agents already do the work.
Nobody is comfortable leaving them to it.
Memnox exists to change that. Not to sell protection, but to raise how much a team can safely let its agents do without somebody watching, one answered question at a time.
The problem we started from
Agents arrive through installs, provider seats, pipelines and the products a team already buys, and they are counted in four different places and nowhere together. Each was granted access once, by somebody who has moved on, and none of it was ever narrowed. It was survivable while the only things acting on any of it were people.
What we are building
Three layers, and only one of them is defensible on its own. What the team knows, which alone is a search product. What an agent may know and do, which alone is an access control product the platforms will ship. And whether this specific action, by this agent, on this task, at this moment, proceeds. The third needs both of the others, and it is the one nobody holding only one of them can build.
Humans stay in control
Nothing here enacts its own rules, and that is the ceiling in perpetuity. A rule is proposed and simulated against real traffic, and on a team it is approved by somebody other than its author. An incident can lower an agent's authority on its own; nothing raises it without a person. Enforcement starts in observe mode, so a rule is watched before it is allowed to bite.
Two of the three is a feature.
Three is the position.
What an agent can do, what it actually did, and what your team meant are each separately knowable and nowhere joined up. Memory alone is a search product. Authority alone is access control the platforms will ship. Whether this action, by this agent, at this moment, proceeds needs both.
reads who owns the service and what is frozen
Owners, approval chains, freezes and past decisions, drawn from the systems the team already runs and read by every agent rather than copied into each one. Claude Code, Cursor, Codex CLI, Claude Desktop and any client speaking MCP get the same answer.
What the team knows: who owns this, who approves that, what is frozen, what was decided before. Built continuously from the systems already running, and read by every agent rather than copied into each one.
What we hold to
Memnox never does the work
No step writes the code or issues the refund. It hands an objective to an agent the team already runs, with the context, the constraints and a capability rather than a key, and records what happened. The moment it executes, it competes with every agent framework instead of governing them.
Nothing unattributable
Every decision, action and refusal names its source. If it cannot be traced, it does not belong in the record.
The open runtime
The runtime that enforces policy is Apache-2.0, documented and yours to run. Trust in a governance layer that cannot be inspected is not trust.
Give the primitive away
A policy engine, identity, isolation and a kill switch are being open sourced by companies with more distribution. Charging for those is a losing position. Everything one person needs on their own machine is free and needs no account; what is priced only exists once a second person is involved.
No fictional agent, anywhere
No sample workspace, no seeded assistant, no staged attack. The first run reads the reader's own machine, which is harder to build and the only version that convinces in the first thirty seconds. Nothing on screen may be a figure the product cannot derive.