# Nerve — agent operations with deploy guardrails

Nerve · agent operations

## Your agents ship code. They _cannot_ ship to production.

Not a policy. Not a prompt. Architecture.

Nerve is the operations layer for AI agent teams. Every task visible, every deploy human-approved by default, every completion backed by a real commit. A managed service — or on-premises by enterprise engagement.

[Book an assessment](https://dubhlan.com/waitlist?ref=assessment) [Get early access](https://dubhlan.com/waitlist) See how the gate works ↓

The problem

## You can see what your agents said. You can't prove what they did.

Every tool in this category shows you traces — spans, tokens, prompt versions, evaluation scores. The inside of the model call. All of it useful. None of it answers the question you'll actually be asked.

### An agent did something unexpected in production.

The incident was minor. Not being able to explain it afterward was not.

### Someone asked for your AI governance story.

A board member, or an enterprise prospect's security questionnaire. The honest answer was silence.

### You priced the hire.

Dedicated AI operations, $180K and up, for a function that didn't exist eighteen months ago. It isn't a headcount you can get approved this year.

The guarantee

## The tools your agents will never execute.

Refused at the dispatch layer, for every agent, by default — with no per-agent allowlist.

Refused — among others

```
kubectl_apply✕ refusedkubectl_set_image✕ refusedkubectl_rollout_restart✕ refuseddocker_build✕ refuseddocker_push✕ refusedterraform_apply✕ refuseddeploy_app✕ refuseddeploy_rollback✕ refused…and every other path thatmutates production stategit push → main✕ refused
```

What the agent receives

```
❌ Deployment is managed by the
   orchestration tier. Agents cannot
   merge to main, build images, or
   roll out to k8s directly.

   1. Make your changes locally.
   2. Commit them (push=false).
   3. Push the feature branch.
   4. Call request_deployment(...)
      — that opens a human gate.
   5. A human approves; the
      server-side runner merges
      the PR and deploys.
```

And what lands in your audit log when one tries

```
AUDIT  2026-07-19 14:22:07Z
  agent    Forge · backend
  action   deployment tool blocked
  tool     kubectl_apply
  outcome  refused → handed off to SRE
```

### The point isn't that we have guardrails. It's that we can show you the log of every time one held.

The only path to production is a deployment request, a human gate, and a runner that executes server-side — in a process your agents have no way to address. **Human-approved is the default, not the ceiling:** if you decide an agent has earned it, you can hand it autonomy to ship on its own — and every deploy it makes stays tracked, attributed, and visible in the very same trail. Giving up a little control is a choice you make on purpose, and can reverse whenever you want.

Separation of duties

## Controls your auditor already understands.

### Closing work can require someone else's sign-off.

With mandatory review on, moving a task to done requires leadership or the assigned reviewer. It's one gate, called from every door — the agent's tool path and the operator's drag-and-drop alike. There's no route around it because there's only one door.

### An agent cannot read a credential it wasn't granted.

Secret access is default-deny: per agent, per integration, per field. No grant, no secret. Your frontend agent cannot read your production database password, and that isn't a policy anyone has to remember to write.

### An agent can ask to deploy. It can never approve its own request.

A deploy request opens a human gate, and whoever asked can never approve it. Maker and checker are different, by design.

Maker-checker. Least privilege. Segregation of duties.

The vocabulary is a hundred years old. We applied it to staff who aren't people.

You hold the dial

## Speed and spend are settings. You choose both.

Nerve ships cautious. You dial up autonomy and dial in a budget on your own terms — and neither dial ever costs you the record of what happened.

The autonomy dial

### Human-approved by default.

Every deploy waits for a person. When an agent earns your trust, **raise its autonomy** and let it ship within limits you set. The moment you do, every deploy it makes stays attributed, audited, and visible — the same trail as a human's. Giving up a little control is deliberate, visible, and reversible.

Default: gated · tracked · traceable · visible

The spend dial

### A budget that actually stops.

Set a ceiling — in **tokens or dollars**— on any**tenant, team, project, agent or task**. Budgets stack: a call must clear every ceiling that covers it, so a tenant cap really caps the tenant. Cross a warning line and you're told; hit the ceiling and work **pauses for a human**. A runaway agent becomes a budget line, not a surprise invoice.

Enforced in the model gateway · conjunctive · warn → pause for a human

The workforce

## An org chart, not a DAG.

The full Nerve team is 30 agents that have identities, not configurations. Each has a written brief, a discipline, its own model, its own toolset, and its own credentials.

Leadership

Cortex orchestration

Apex CEO

Vector CTO

Meridian CRO

Prism product

Counsel legal

Engineering

Forge backend

Pixel frontend

Bridge API

Vault data

Beacon mobile

Probe QA

Velocity performance

Lens UX

Infrastructure

Pulse SRE

Bedrock platform

Security

Aegis CISO

Cipher appsec

Sentry workload

Specter threat hunting

Fracture red team

Shield privacy

Go-to-market

Scout research

Quill content

Traction growth

Demo sales engineering

Everywhere else, an agent is a stateless object that exists for the length of a run. Here it's someone you can assign work to, review, and hold to a standard — which is why your VP of Engineering can read this screen without a translator.

Start with 9, 22, or all 30 depending on the profile you pick. Add whole teams — security, QA, DevOps, legal — as one-click templates.

Proof

## “Done” means there's a commit.

Not a status update. Not a summary of what was attempted. A real branch, a real pull request, a real deploy record, attributed to the agent that authored it.

Agents are good at reporting success. The git log doesn't care how confident anyone sounded.

Capabilities

## What else is in the box.

### Delivery

- **Kanban** across the whole workforce, epic → feature → task
- **Human-in-the-loop gates** with the full handoff packet
- **DORA four keys**, computed from real deploy records
- Environment **promotion** lanes
- **Deployment freeze** that holds work at the door and resumes it on lift
- **Rollback**, and automatic revert when a post-merge build fails
- **Live Flow** — a real-time graph of dispatch and handoffs, replayable

### Security

- **Vulnerability management** backed by real CVE data from OSV
- **CycloneDX SBOM**, plus an **AIBOM** for your AI supply chain — models, agents, tools, MCP servers, prompts, lineage
- **Cloud posture** scanning, evaluated live against your Kubernetes
- **Secret vault**, AES-256-GCM, with default-deny per-agent grants
- **Secret-leak interruption** — the stream is cut when a credential appears, and a rotation gate opens
- **Prompt-injection firewall** — deterministic, reads override attempts across 21 languages, no model call of its own
- **Compliance evidence** mapped to the control families your auditor uses, with recorded suppression reasons

### Cost & operations

- **Spend ceilings** in tokens or dollars, per tenant, team, project, agent or task — pause for a human on exceed
- **Cost** per agent and per model, with daily trends
- **SRE golden signals** across every registered cluster
- **Client telemetry** — errors and usage from the product your agents shipped, closing the loop
- A **savings ledger** that labels every figure measured or estimated, because we'd rather you trusted the measured ones

### Enterprise

- **OIDC single sign-on**and**SCIM 2.0** provisioning
- **Audit trail** on every admin action — success and failure
- **Multi-tenant**, tenant-isolated at every query, encrypted at rest
- An **80+-capability permission model** with staged shadow-then-enforce rollout
- **On-premises by enterprise engagement** — Nerve in your own infrastructure, with a licensing check-in

A managed service, or on-premises for enterprise. Models: Claude, vLLM, Ollama, or your own — chosen per agent and per project, so the same agent can run on a frontier model in one project and a local one in another.

[See the full capability matrix →](https://dubhlan.com/capabilities)

Fit

## Who this is for. And who it isn't.

### Nerve is for you if…

- You're **10–200 people**, past product-market fit, before real process
- You already run **5–20 agents** and nobody fully understands what they're doing
- You're the person who'd be asked to explain it — and you own that risk
- You need an answer to **“what's your AI governance story?”** that isn't a chat log
- You'd rather a managed service govern your agents than build the oversight yourself

### Nerve is not for you if…

- **You run one agent.** You don't have an operations problem yet. You have a prompt.
- **You won't let any service hold agent metadata, full stop.** Our on-premises option exists, but it's an enterprise engagement — a real cost, not a free download.
- **You want tracing and evals to improve prompt quality.** That's a genuinely different job, and LangSmith and Braintrust are better at it than we are. Use them — some teams run both.
- **You want agents to move faster with fewer checks.** Every part of this product is a check.

The landscape

## Everyone instruments the inside of the agent. We govern the outside.

The useful way to tell these tools apart is to ask what a single row represents.

| Category | Unit | The question it answers |
| --- | --- | --- |
| Observability & eval — LangSmith, LangFuse, Arize, Braintrust, AgentOps | the span | Why did this call go wrong? |
| Gateways — Portkey, LiteLLM, OpenRouter | the request | Route, cache, fail over, cheaply. |
| Frameworks — CrewAI, LangGraph, Bedrock Agents | the run | How do I build and host an agent? |
| Work management — Linear, Jira | the issue | How do humans and agents share a backlog? |
| Nerve | the delivered change | What shipped, who approved it, can I prove it? |

They're better than us at reading the inside of a model call — that's their product and they've been at it longer. Nobody is working on the boundary where an agent's output becomes a change to a real system. That boundary is where your risk actually lives.

Straight answers

## The three things you're thinking.

### “I could build this myself.”

You could. Most of it isn't hard — it's just a lot, and it's load-bearing. The question isn't whether you can. It's whether every hour spent rebuilding this is an hour not spent on the thing only your team can build.

### “We're not big enough yet.”

The companies that needed this yesterday are the ones who didn't think they were big enough. The incident doesn't wait for your headcount to justify the tooling.

### “We don't fully understand agents yet — this feels premature.”

Backwards, we think. You don't master agents and then govern them. You govern them while you learn, and the visibility is what makes the learning fast.

## See what your agents are actually doing.

Early access is application-only — we're setting up tenants by hand, and we'd like to do that well. Tell us what you're orchestrating.

[Book an assessment →](https://dubhlan.com/waitlist?ref=assessment) [Get early access](https://dubhlan.com/waitlist)

Summary: Your agents ship code; they cannot ship to production. Nerve gives AI agent teams full task visibility, human-approved deploys, and proof of what shipped. A managed service, with on-premises by enterprise engagement.

Canonical page: https://dubhlan.com/nerve