See what's open

Agents propose. A gate decides.

ZenOS runs AI agents for software and IT agencies. No agent here can send an email, issue an invoice or publish a post. It writes down what it wants to do, in one sentence. Then a fixed set of five checks — the same five, in the same order, every time — decides whether that happens, waits for a person, or is refused.

See what's open todayHow the gate works

Example proposal — not a live decision

Deliver the monthly status report to [client].

  • Switched on here
  • Agent holds it
  • Available yet
  • Trust & limits
  • No outside content
Allowed

Passes every check. Inside the limits set for this agent.

Scroll

01The outside companies that touch your data

Companies that process data on our behalf: Anthropic (United States), Composio (United States), Fly.io (Frankfurt, Germany (fra)), OpenRouter, Inc. (United States (Google Cloud US regions)), Stripe (Ireland (Stripe Payments Europe), with processing in the United States), Supabase (Frankfurt, Germany (AWS eu-central-1)), Vercel Inc. (Frankfurt, Germany (fra1) for application functions; static files from Vercel's global network; may also process in the United States), Voyage AI (United States (Voyage AI does not publish which region)).

02Decisions

Every proposal is one sentence before anything happens.

This is what those look like — the sentence an agent writes, and what the gate did with it.

  • Allowed

    Deliver the monthly status report to [client].

    Inside the limits set for this agent.

  • Refused

    Send an email to [recipient].

    Earlier in this run the agent read an email from outside the company. A run that has read outside content can never reach an action that sends.

  • Allowed

    Ask [agent] to summarise the projects that slipped this week.

    A pair the owner declared, inside the chain's shared allowance.

  • Refused

    Issue invoice [number] to [client] for [amount].

    Issuing an invoice always needs a person. That ceiling never moves, whatever trust this agent earns.

  • Allowed

    Deliver the delivery risk report to [client].

    Inside the limits set for this agent.

  • Refused

    Post to [platform] as [account], visible publicly, at [time].

    This capability is not switched on yet.

  • Allowed

    Deliver the quarterly status report to [client].

    Inside the limits set for this agent.

  • Refused

    Ask [agent] to send a first-contact email to [n] recipients.

    Something earlier in this chain read content from outside the company. Once that happens anywhere in a chain, the whole chain is closed to sending.

These are examples of the sentences and refusals the product produces, not decisions from a live workspace. Real decisions belong to the workspace that made them, and we do not publish them.

03The path

What actually happens

Five steps. The fourth is the one worth reading twice — it is the only place the path breaks, and it is the reason the rest of this is worth anything.

How one proposal moves through ZenOSWork arrives and reaches the agent. The agent writes a proposal. The proposal reaches the gate. From the gate the path splits in two: an allowed proposal continues to the record, and a refused one stops at the gate and goes no further.WORK ARRIVESAGENT READSPROPOSALTHE GATE — FIVE CHECKSALLOWEDREFUSEDRECORDED
One proposal, from the work that triggered it to the record that outlives it. The path splits once, at the gate, and one of its two branches ends there.

  1. Work arrives

    A schedule fires, or something changes in your project tracker. A run starts. It is handed your company facts, your rules and its own instructions first, then the task — the parts that rarely change go in front, so the expensive half of every model call stays cached.

  2. The agent proposes

    The agent reads what it is allowed to read. It cannot do anything else. The only tool it holds that touches the world outside is a wrapper whose single effect is writing down a proposal — one sentence saying exactly what would happen, to whom, and what it would cost.

    This is not a setting you could turn off. A model is handed two shapes of tool and there is no third: a read tool, or a propose wrapper. There is no configuration of this product in which an agent holds a working send button.

  3. The gate decides

    Five checks, in the same order, every time. Is this kind of action switched on for this workspace at all? Does this agent hold it? Is it available yet? Is it inside this agent's trust level and amount limit, for this kind of action specifically? And does it break any of the rules you set — amounts, recipients, regions, hours, daily caps?

    Any check failing produces a proposal waiting for a person, or a refusal. Never an action. The gate never reads the agent's instructions, so nothing written into an agent — by you, by a colleague, or by someone else's email — can grant it a tool, raise its trust level, or change a rule.

  4. A refusal

    An agent reads an email. The email contains a line telling it to forward something.

    Nothing happens. Not because the agent judged it well — because the moment that run read content from outside the company, every tool that sends was removed from what the model can even see. And if one reached the gate anyway, the gate refuses it again, independently, having been told nothing by the first check.

    A cleverer prompt does not help here. There is no tool on the other side of it to reach.

  5. The record

    Every decision is written in the same database transaction as the thing it describes. Not afterwards, not in a queue — if the record cannot be written, the change does not happen either.

    Each entry is chained to the one before it, so a gap or a rewrite shows. And each one stores which version of the agent's instructions and which pieces of your own knowledge produced it — their identifiers, never their contents. So when someone exercises their right to be forgotten and the content is genuinely deleted, “why did it do that” still answers.

04The gate

Five checks. Same order. Every time.

The gate never reads an agent's instructions. Nothing written into an agent — by you, by a colleague, or by someone else's email — can grant it a tool, raise its trust level, or change a rule.

Check 01 / 05

Is this kind of action switched on here at all?

Before anything about this agent is considered, the workspace itself is asked. A kind of action nobody has enabled does not get evaluated — it is refused, and the refusal is recorded.

Fails closed — never into an action.

Check 02 / 05

Does this agent actually hold it?

Agents are given what they need and nothing beside it. An agent that was never handed a way to spend money cannot propose spending money, however it is asked.

Fails closed — never into an action.

Check 03 / 05

Is it available yet?

Some things are built and tested. Some are waiting on a third party we do not control. The gate refuses the second kind on the server, with a record — it is not merely hidden in the interface.

Fails closed — never into an action.

Check 04 / 05

Is it inside this agent’s trust level and its limits?

Trust level and the kind of action are checked together, never apart. An agent trusted with internal reports is not thereby trusted with an invoice. There is no company-wide setting that raises everything at once — that would be a bug here, not a feature.

Fails closed — never into an action.

Check 05 / 05Refused

And the one that ends here.

The moment a run reads anything from outside the company — the body of an email, a page it fetched, a message from a connected tool — every tool that could send, spend or publish is removed from what the model can even see. If one reaches the gate anyway, the gate refuses it again, independently.

This branch does not continue.

05What they do for an agency

6 agents are open today.

Each one is described below in the words of its own readiness record, and the ones that are not open yet are listed too, with what is holding each one. Whatever an agent reads, all it can do about it is write a proposal — it never holds a working handle to send, spend or publish.

01Open today

Client health

Reports which client relationships look at risk, from your own internal notes and project data. Reads nothing from outside your company.

02Open today

Client status reporting

Writes your client status reports from your own project data.

03Open today

Delivery risk

Writes the regular delivery risk report for each project from your own uploaded tracker and timesheets. Watching only to begin with.

04Open today

Proposal estimate

Drafts proposals and estimates from your own past project data. When the brief comes from outside your company the run is treated as untrusted, so delivery needs a second run with your approval in between.

05Open today

Team utilization

Team workload reports are available. ZenOS totals the hours from timesheets that an owner or admin uploads, so the workspace can see how much of its team time was billable and how much capacity was available. Per-person detail stays off unless the workspace turns it on; with it off, only totals are read. These reports never judge how an individual is performing.

06Open today

Twin root cause

Explains the measured cause behind a slow step. Never guesses at a cause your own data did not show.

07Not built yet

Ads performance

Reviewing advertising performance is not available yet. Reading your data is built and tested, and so is the narrow tool that can only ever create a paused campaign — it has no way to switch one on. What is missing is our decision to let ZenOS act on a real advertising account for the first time.

08Not built yet

Billing invoicing

Billing and invoicing is not available yet. The agent is built and tested; it is waiting on a real payment account connection.

09Not built yet

Content social

Drafting social content is not available yet. The agent is built and tested; it is waiting on a real social account connection.

10Not built yet

Inbox triage

Triaging your inbox is not available yet. The agent is built and tested; it is waiting on a real mailbox connection.

11Not built yet

Lead gen outreach

Lead generation and outreach is not available yet. The agent is built and tested. What is outstanding is a legal review of using third-party contact data, and four weeks of warming a sending domain — neither of which is something we can shorten.

12Not built yet

Social intel

Watching competitors is not available yet. The agent is built and tested; it is waiting on real provider connections.

13Not built yet

Twin benefit tracker

Reports the freed time, quality and financial effect of a change, kept separate. Freed time is never shown as a saving.

14Not built yet

Twin change effort

Gives a rough estimate of the effort and cost to carry out a proposed change.

15Not built yet

Twin data readiness

Assesses whether enough of your own process data has arrived yet to analyse it, and names exactly what is missing.

16Not built yet

Twin intended state

Builds the process your regulations, internal rules and staffing plan actually require, each step linked to the exact rule that requires it.

17Not built yet

Twin process reconstruction

Explains how the process actually runs today, and where that differs from what your rules intend.

18Not built yet

Twin steering status

The pilot steering report: the real cause, what can change, the expected effect, the rough cost, and whether to repeat it elsewhere.

19Not built yet

Twin target design

Proposes a better version of the process, asking why every remaining step exists before it is kept. Always for a person to approve, permanently.

We would rather tell you an agent is not ready than sell you one that refuses every time you use it.

06Why this exists

Why this exists

Competitors have equivalent agents. What they do not have is the guarantee that an agent never holds a working handle to anything that changes the world. It writes a proposal. A deterministic gate decides. Every decision is recorded against the exact instruction version and knowledge that produced it.

07Autonomy

How much an agent is allowed to do

4 levels. They are set per agent, and separately for each kind of action that agent can take — so one agent can be trusted with internal reports and still need you for everything else. There is no company-wide switch, and we will not add one.

  • Observe

    Watching only. The agent proposes nothing.

  • Draft

    The agent proposes; a person decides every time. Reached by asking for it and then earning it — at least twenty completed runs across at least fourteen days, no halted runs and no unresolved rubber-stamp flags. You ask; the nightly check decides.

  • Delegate

    Inside limits you set, a policy decides instead of a person. Earned from your own approval history, never bought — no plan and no payment raises it.

  • Operate

    Operate is available. An agent reaches it only by earning it: forty or more decisions, three or more people, a fortnight of activity, and a clean record — measured nightly and written down. You can cap any agent below it at any time, and that cap always wins.

Earned, never bought

An agent moves up only when a nightly job can measure that it should: enough decisions, by enough different people, over enough days, with a rejection rate that is neither zero nor high, no refusals at the gate, and no open flags.

A rejection rate of zero fails on purpose. Nobody rejecting anything does not mean the agent is flawless. It means nobody is reading.

Approving without reading earns nothing

The product watches for it specifically: decisions taken faster than the proposal could be read, one person deciding everything, decisions taken in bulk, decisions taken without ever opening the detail. Two of those signals and the agent is flagged — promotion blocked, and demoted if it had already been promoted.

Demotion is instant. It does not wait for the nightly job, and it is not confirmed with anyone first.

08Plans

A plan controls cost. It never controls autonomy.

A plan controls cost, model access and volume. It does not control how much your agents are allowed to do. Those are two separate things, and they never touch.

  • Free

    €0per month, excluding VAT

    Free. One agent of your choice, watching only until it earns more, with a monthly allowance of tasks included. No card needed.

    Get started

  • Own key

    €99per month, excluding VAT

    Own key. Use your own model provider key: your agents run on it, and the provider bills you for it, not us. A paid plan changes quotas, never trust.

    Not yet

  • Pro

    €490per month, excluding VAT

    Pro. More agents, more included tasks and more models than the free plan. A paid plan changes quotas, never trust.

    Not yet

  • Max

    €1,490per month, excluding VAT

    Max is not available yet. It offers more agents than are currently available, and we would rather not sell a plan we cannot fill.Waiting on: this tier's agent allowance exceeds the number of agents actually available

    Not yet

  • Ultra

    €3,900per month, excluding VAT

    Ultra is not available yet. It offers more than is currently available, and we would rather not sell a plan we cannot fill.Waiting on: this tier's agent allowance and bespoke delivery exceed what is actually available

    Not yet
  • Free needs no card. No card is asked for on that plan, at any point.
  • Your own model key still meters embeddings. Turning your documents into something searchable costs us money whether you bring a key or not. We would rather say so here than surprise you later.
  • Running out stops the work. It does not produce a bill. Going over your allowance is switched off unless you switch it on, and if you do, you set the hard second ceiling yourself.

Paying more never raises a trust level.There is no plan on this page that buys autonomy. A trust level comes from an agent's own approval history and nothing else. The product itself enforces this, and automatic checks that must pass before every release would stop a release that broke it.

See the full table and what's open

09A second product, the same gate

ZenTwin: an organisational twin for public administration

ZenTwin is a separate product, for a different kind of customer, built on the exact same gate and the same audit trail above — never a looser version of either. It models how an organisation is meant to work, how it actually works, and how it wants to work, and runs the same governed agents over that model to find real causes, design better processes and measure the benefit. Its first pilot is the Slovenian Ministry of Public Administration.

Aggregate, never individual

No kind of action here may decide about a person

ZenTwin analyses processes in aggregate. No kind of action an agent can propose may create, change or decide an individual administrative decision, claim, permit or assessment — that possibility does not exist in this product, by design, not merely switched off.

Before it ever arrives

Identifiers are replaced at the source

Pseudonymisation happens before ingest, at the data owner's own system, with the key staying with them. An extract carrying a name, a national identification number or an email address is refused, not merely redacted.

A floor under every output

Nothing smaller than a group is ever shown

No output describes a group smaller than the minimum size a tenant's own data protection officer sets, and no per-person detail exists in the product to switch on — enforced in the views an agent reads, never in a prompt.

Measured, not implied

Freed time is reported, never claimed as a saving

Every figure ZenTwin shows is a row with its own measured inputs. Deterministic code computes it and the model only explains it — freed time, quality and financial effect are measured and reported separately.

Open today

ZenTwin: understanding how your organisation actually works, and finding better ways to run it. Every individual ZenTwin capability stays off until it has been certified against a customer's own real systems, whatever this heading says about ZenTwin as a whole.

10Deployment

The same code, the same gate, your own infrastructure

A deployment profile is configuration, never a fork of the product. Both profiles run the same migrations and the same checks that decide every proposal — nothing about the guarantee above is relaxed for either one.

Cloud

Hosted by us, in Frankfurt, Germany

Your workspace runs on our own infrastructure in a named European Union member state — never the general “Europe” grouping a provider could quietly resolve somewhere else — with sign-in, billing and support handled for you.

Sovereign

Self-hosted, on infrastructure you control

The same application and the same migrations run on your own PostgreSQL, your own object storage, your own secret store and your own sign-in — OpenID Connect is built; SAML is not yet. There is no Stripe and no public sign-up in this profile: it is sold and operated on contract.

11Provenance

Where this came from

ZenOS was not designed in the abstract. It is a rebuild of the system that runs Zenon, our own software agency, which has operated largely autonomously since June 2026.

That system is the reference architecture. Every part of this — the propose-only wrapper, the five checks, the rule about outside content, the record — exists because running an agency on agents made it necessary, in that order.

What we are not going to claim. ZenOS has been live in production since 27 September 2026, on infrastructure in Frankfurt, Germany. Being live is a smaller claim than “it has run a customer's work”, and we are not going to blur the two. Which connections to real mail, invoicing and advertising accounts are certified is not a matter of opinion: the pricing page lists each one with its status, read from the same records the product checks before it lets anything run. As of 28 September 2026, no customer's mail, invoicing or advertising account has been acted on. The guarantee above is enforced by the product itself, and a set of automatic checks that must pass before every release would stop a release that broke it.

Awaiting the founder's input

Zenon's own operating figures — how many agents, how many scheduled routines, how many proposals decided and refusals caught — are recorded internally but are not published here yet. They go up when they have been confirmed as current and cleared for publication, and not before.

Start free.

Free. One agent of your choice, watching only until it earns more, with a monthly allowance of tasks included. No card needed. Try it against your own data before you pay anything. If that is not convincing, nothing we write here should be.

Start free

Your workspace is hosted in Frankfurt, Germany — a named country, not a general “Europe” region that could quietly resolve somewhere else. The models your agents run on are operated by providers outside the EU. Every company that touches your data is named on one page, with where it processes and what agreement is in place.