Agents
Agent runs with a human at both ends
An agent run starts as a plan you read and approve, executes inside enforced limits on its own branch, gets graded by an independent review pass, and ends with a merge decision only a person can make. Every step is on the record.
How a run works, end to end
One loop, always in this order. The two accented stages are human decisions: nothing executes without the first, nothing ships without the second.
The plan is a real object
Planning writes nothing. The plan (approach, steps, expected files, risk notes, target branch) is persisted on the run and waits for a decision. Rejecting it ends the run without touching the repository.
The review is genuinely separate
A second model call with fresh context, given only the objective and the diff, produces a structured verdict: requirements checked, findings, a recommendation. It is labeled honestly as a second agent pass, and the human decision still follows it.
What a run may do
The run page shows this envelope before you approve. Every line corresponds to enforcement on the server: it is a boundary, not a promise.
Write scope
keelson-ai/* branches only, never the default branch. The branch is fixed at plan time, so the approver knows exactly where the agent will write.
Path scope
Repository-wide by default, minus the always-forbidden paths. The approver can narrow a run to specific paths, and edits outside the approved scope are rejected server-side before anything is committed.
Always forbidden
Git internals and CI configuration (.git/, workflow and pipeline files) are refused in every run, so an agent cannot rewrite history or grant itself compute.
Secrets
None. Agents see secret names only; values stay encrypted and are unreachable from agent code, with redaction middleware as a backstop.
Merge and deploy authority
None. Merging and deploying are human actions reached only through human-gated flows. There is no agent code path to either.
Change size
At most 20 files per run, 200 KB each. A run that needs more is a run that needs splitting.
Your provider, your key
Keelson is the control plane, not the model. Anthropic is supported out of the box, and any OpenAI-compatible endpoint works. Bring your own key on every plan, including Free: BYOK usage is not metered against platform actions, and a workspace-level no-training preference is on by default.
Limits, caps, and the off switch
Controls that hold even when a run goes wrong.
Usage caps and visibility
Every provider call is metered per workspace against a monthly action cap, with warnings before limits. Hitting a cap blocks the action with a clear message, never a surprise charge.
An off switch
Agent runs sit behind a global kill switch, and any workspace can disable them entirely. Role permissions control who may request and approve runs.
Redaction as a backstop
Every provider call passes through redaction middleware. Vault values stay encrypted and are never included in model context.
The honest scope: runs are plan-approved and single-pass today. One request produces one plan, one constrained execution, and one verdict. Long-running autonomous loops are not built, and that is a control decision as much as a roadmap one: each expansion of agent autonomy ships together with the supervision it needs.
Read-only assistance, included
Alongside runs, the workspace answers questions without writing anything. Each of these is metered and audit-logged like everything else.
Ask a repository question
Natural-language Q&A over the repository's contents.
Explain a file or an error
Plain-language explanations grounded in your code.
Summarize a review request
What a change does, in one readable paragraph.
Generate a README
Drafted from the actual repository contents, not boilerplate.
Every plan includes agent runs. Free gets platform actions, and BYOK works everywhere.
Anthropic and OpenAI-compatible providers are supported.