Nerve compared with alternatives

Questions to put to any vendor, including us

These are evaluation questions, not claims about anyone else.

• Can an agent approve its own request?
• Can an agent reach production or protected branches directly?
• Are refused actions recorded?
• Does an agent ever hold your provider credentials?
• Does isolation between tenants hold even when application code is wrong?
• Where does it run, and what does running it yourself cost?

Nerve’s answers, as of the review date

• An agent can ask to deploy; it can never approve its own request.
• By default, agents cannot execute production deploys.
• Agents cannot push to main, master or production branches.
• Every blocked attempt is audited.
• Agents never hold provider credentials; the platform performs the privileged action on their behalf.
• Tenant isolation is enforced at the database and fails closed: even the database owner role cannot read another tenant’s rows.
• Nerve is a managed service by default; on-premises is available for enterprise customers at significant cost.

Alternatives