Powerloom is the control plane for managed agent fleets. Directory-grade RBAC, OUs, and audit — so the agents your teams ship have the same identity story as the humans.
If you've configured Active Directory, you've already used Powerloom's mental model. OUs, security groups, role bindings, deny precedence — ported to agents, their tools, and their runtime.
Nest OUs the way engineering already does — by team, environment, or tenant. Agents, MCP deployments, and human members live inside an OU and inherit its policy.
Grant AgentAuthor to eng-leads. Deny invocations outside business hours. Stacked bindings resolve with AD semantics — deny always wins, inheritance flows down.
Agents call MCP tools through the Powerloom runtime. Every request is checked against the merged policy, logged with a decision, and streamed to the session console in real time.
Every surface the IT admin already expects — directory, RBAC, deployment, audit — designed for agents from the ground up. No SaaS glue.
Nest agents and MCP deployments under OUs that mirror your org chart. Inheritance, delegated admin, and cross-OU policy just like AD.
Built-in roles (OrgAdmin, AgentAuthor, DeploymentOperator) + custom roles scoped to an OU or the whole org. Deny wins; merges are deterministic.
Write an agent once, deploy to an OU. Managed Claude runtime, scoped tools, sandboxed sessions, and pinned MCP server versions.
Deploy postgres, files, slack, and custom MCP templates with health-checked rollouts. Config, secrets, and RBAC are all part of the same manifest.
Every agent turn, tool call, and policy decision lands in an append-only session log. Replay, export to SIEM, redact at read time.
Compose agents into DAGs with approvals and branches. Run in design mode to trace; in run mode to ship. Same policy plane.
Every OU, binding, agent, and MCP deployment is a YAML manifest. Apply with the CLI, review in PR, roll back on drift.
powerloom apply — plan, diff, rollout$ powerloom apply -f acme/ // planning changes against ou=acme … + ou acme/engineering/platform + role-binding eng-leads → OUAdmin (scope=platform) ~ role-binding contractors ✗ AgentAuthor (effect: allow → deny) + agent pg-writer (model=claude-opus-4-1) + mcp-deployment pg-analytics (template=postgres v3) // 5 changes · 0 warnings. apply? [y/N] y ✓ applied in 1.4s · run apl_9f2ac4
Zero-trust by default. Every agent action is authenticated, authorized, and logged — and every policy decision is reproducible.
OUs, security groups, role bindings, and deny precedence. Import from Okta, Entra ID, Google Workspace via SCIM.
SAML 2.0 and OIDC with any IdP. SCIM 2.0 for user and group provisioning. Service-account identities for agents.
Every session, tool call, and policy decision. Streamed to Splunk, Datadog, S3. Cryptographically signed.
Audited annually. HIPAA available on Enterprise. FedRAMP Moderate in progress.
Ship agents from the CLI or the console. Either way, your team sees the same directory, the same policy tree, and the same live sessions.
Start in your sandbox tenant in under 10 minutes. No quota, no CC.