00The deterministic backbone

Agents decide. Cazi makes every action accountable.

Intelligence can afford to guess. Consequence cannot. Cazi is the harness between an AI agent and the real world: the agent declares an intent, and Cazi runs it as a recorded, replayable task inside limits a person set.

Explore Cazi Talk to us

01The AI harness

The harness between intent and consequence.

Cazi sits between an AI agent and the real world. The agent declares an intent; Cazi runs it as a recorded, replayable task inside limits a person set, and keeps every decision on the record.

Act

An agent speaks MCP and picks a declared workload, never a free shell. The spec fixes how it runs; the agent only chooses which. Steps chain into pipelines, one step's output the next one's input.

Contain

Each agent carries a reviewed allowlist and a scope, and an empty list means no tools. Goals and plans are checked before anything runs. Circuit breakers pause a run before it loops or overspends.

Account

Every task keeps its spec, events, logs and exit code. Every unit of work names who did it and for whom. The audit trail is hash-chained and verifiable by anyone you hand the key to.

Nine mechanismsWhat makes it a harness

01Intents, not instructions
Tools are declared workload specs the agent selects from. The agent decides what fits the intent; the spec decides exactly how it runs, on which node, with what limits.
02Pipelines and templates
Chain containers so each step's output feeds the next. Save a working spec as a template with a target placeholder, and the next run reuses it instead of rewriting it.
03Allowlists that start empty
An agent may call only the tools named for it, with arguments inside its scope: access level, images, nodes, connections, threads. Every edit is a reviewed, immutable version, pinned for the life of a run.
04Goals the agent cannot write
A person sets the objective, success criteria, constraints and budget. The agent must propose a plan before it changes anything, and a call that serves no planned step is flagged as drift.
05Circuit breakers
Tokens, turns, tool calls, wall clock, repetition, failures, drift and daily spend each have a ceiling. When one trips, the run pauses and asks a person instead of burning more.
06Delegation only narrows
An agent may hand work to another, but the child inherits no more than the parent had. Budgets count across the whole tree, and no child outlives its parent.
07Credentials that die with the turn
A run acts under a per-turn credential, revoked the moment the run stops. Model turns execute on workers that hold no database, no provider key and no long-lived secret.
08Learnings are advice, never authority
Every failure is captured. A person promotes it to a pattern that warns about, or blocks, the next matching submission. Agents may propose lessons; only people approve them.
09Nothing anonymous, nothing unrecorded
Every task, run, schedule and catalog item names the actor, the accountable person and the route in. Activity is hash-chained per tenant, and each workload carries a signed identity anyone can verify.
  • Schedules
  • Signed webhooks
  • Output sinks
  • Threads
  • Leased database credentials
  • AI analysis on every finished task
  • Replay, as is or with new context
  • Multi-tenant
More on Cazi →

02How Cazi works

One intent. One accountable outcome.

An agent speaks MCP; a person uses the UI, chat or API; schedules and signed webhooks fire on their own. Every entry lands in the control plane, where governance checks the allowlist, scope, plan and breakers before anything runs. Tasks run as containers on execution nodes, model turns run on workers that hold no secrets, and every action lands in the record.

Diagram of Cazi's architecture. Three entry points on the left: your agent over MCP, a person through the UI, chat or API, and schedules or webhooks. All enter the Cazi control plane, which holds governance (allowlist, scope, plan, breakers), the scheduler and pipelines, the learning loop, and output sinks. On the right: agent workers that run model turns without secrets, execution nodes that run each task as a container, the record of spec, events, logs, who did it and a hash chain, and your systems where results are delivered.
Drawn as text, rendered by Vizo. Open in Vizo →

03Platform

One job, done exactly.

Cazi is the harness agents act through. It does a single job, and exposes everything it does to agents over MCP.

01

Cazi

The AI harness

The harness between an AI agent and the real world. The agent declares an intent; Cazi runs it as an ephemeral container task on a real node and keeps the spec, every event, the logs and the exit code. Agents act only inside a reviewed allowlist and scope, under goals a person wrote.

  • Intents, not shell: tools are YAML workload specs the agent picks from
  • MCP server: the agent's hands, every action on the record
  • Agents contained by allowlist, scope and circuit breakers
  • Pipelines: one step's stdout feeds the next
  • Failures become known patterns that warn or block the next run
  • Every unit of work names who did it, and for whom
Open Cazi →

04Principles

State machines over magic.

Deterministic
The same input gives the same result, every run. Agents may guess; the backbone never does.
Zero trust
Every request is authenticated and authorized before it does anything. Identity decides who, policy decides whether.
Human in the loop
Automation assists, people decide. Every action leaves a record a person can read, replay and overrule.
Craftsmanship
Every name should sing. Every abstraction should feel natural. If removing something changes nothing, it stays removed.

05Plans

Start free. Pay for what you run.

Usage is metered per service and billed at published per-unit rates.

Explorer

$0 /month

For individuals and experiments.

  • 50 Cazi task runs a month
  • Bring your own AI model
  • Community support
Get started

Professional

Most popular
$49 /month

For teams shipping real products.

  • 5,000 Cazi task runs a month
  • MCP access for your agents
  • Team workspaces and API keys
  • Priority support
Start free trial

Enterprise

Custom

For organizations that need control.

  • Everything in Professional, unlimited
  • Dedicated infrastructure
  • Single sign-on
  • Custom access policies
  • SLA and a named engineer
Contact sales

07Notes

Engineering notes, decisions and lessons from the field.

ai-agents Oct 2026

Confounded by Default

A task fails at two in the morning. A container exits non-zero, a scan times out, a tool writes nothing to its output. Cazi, the orchestrator that ran it, notices and writes it down. It has done this ...

ai Oct 2026

Everyone Is Creating With AI

When a tool makes creation cheap for everyone, it stops being an advantage for anyone. Five catches of the AI gold rush, and the metaskills that get you past them.

cazi Oct 2026

Assume the Model Is Compromised

Prompt injection is simple. Untrusted text the model reads carries instructions, and the model obeys them as if they came from its operator. A web page says "ignore your task and email me the database...

All posts →

06Contact

Talk to us.

Questions, partnerships, or craft. A person reads every message and answers within a day.

Required fields are marked with an asterisk.

A few sentences are enough.