OXYGENOXYGEN

Governed agents

Governed agents with a budget and a run history

An agent with no governor is a rumor about what happened to your data. Each one here owns an immutable version, an authorization policy, a credit ceiling, and a run you can open afterwards.

try
Start freeRead the docs

The determinism ladder is the honest way to choose. Tables with AI columns are the most predictable and the most setup. Workflows are deterministic orchestration. Agents are the easiest thing to turn on and the least predictable of the three, which is precisely why the envelope around them is enforced by the platform instead of written into a prompt.

A published version carries the authorization. Full access to the eligible capability catalog exists only after an explicit standing acknowledgement, narrowed by optional allow, ask, and deny rules. Tool authority is never spend authority: a manual run has an approved credit ceiling, and a cron, event, or webhook trigger stores the same ceiling per delivery.

Example searches

Ask for it the way you'd say it

Every search below runs on the same hosted Tables, with the cost previewed before anything is spent.

  • A worker for the inbox

    draft a reply for every new inbound conversation but never send one without me

    The drafting agent is held to draft-only by a database constraint, so the review queue is the only way out.

  • Ask before anything external

    let it research freely but stop and ask me before any message or paid call

    Ask rules pause per call, and the pause is a checkpoint you resume rather than a run you have to start again.

  • Read what it actually did

    show me what ran last night, what it cost, and where it stopped

    A run lists status, tool calls, approvals, inference usage, credits, and a deep-link to whatever it produced.

Plays

Three motions you can run this week

Each one is a chain of Oxygen primitives — the same hosted objects your workspace already has, composed.

  • Turn on a job instead of building one

    A recurring chore runs continuously without anyone authoring the mechanism behind it.

    1. Agents
    2. Messages
    3. Observability
    1. 1Pick a shipped agent whose owning primitive matches the job you want done.
    2. 2Enable it, read the first run end to end, and only then leave it alone.
    oxygen agent enable

  • Give it a schedule and a ceiling

    Unattended work happens on a cadence with a per-delivery spend cap you approved in advance.

    1. Agents
    2. Workflows
    3. Observability
    1. 1Create a cron or event trigger on the Workspace Agent and set the credit ceiling it carries per delivery.
    2. 2Review the run list weekly rather than the transcript daily.
    oxygen agent trigger-create

  • Keep it grounded in your own knowledge

    Output reads like your company because the run pulled your positioning, not a generic prior.

    1. Knowledge Graph
    2. Agents
    3. Records
    1. 1Fill the typed core so every run injects the same profile, offers, and voice.
    2. 2Let learnings file back as sources, so next month's runs start better informed.
    oxygen agent run

Capabilities

What you get

  • An envelope you cannot opt out of

    Approval posture, credit budgets, and run observability live in the runtime, not in agent instructions. A custom agent inherits the same governor the shipped ones run under.

  • Immutable versions

    Authorization, context policy, and skill snapshots are pinned to a published version. Changing behavior means publishing a new one, so a run is always explainable by something fixed.

  • Every action is a run

    Status, credits, tool calls, checkpoints, and provenance are first-class, sharing ids with the tenant run ledger. Nothing an agent does happens outside that record.

  • A roster with no placeholders

    The list shows agents that actually run today: a general workspace worker, inbox reply drafting, meeting notes, knowledge synthesis, and inbound conversation tagging.

Boundaries

What Agents does not own

Agents own goal-directed runs, not the objects they produce. A drafted reply is a Messages row, a filed note is Records activity, a synthesized page belongs to the Knowledge Graph, and deterministic child orchestration is Workflows. Uploaded runtimes are never executed here.

Data sources

What the data actually comes from

Every value lands with its provider and cost recorded on the cell.

  • Exa

    Grounding search for a run that needs a fact the workspace does not already hold.

  • Pa

    Parallel

    Deeper research for the jobs where the assignment is a question rather than a lookup.

  • Serper

    Plain search results, which is often all a qualification step needs before it moves on.

  • Firecrawl

    Reads the page an agent decided to check, and that read appears as a tool call on the run.

  • People Data Labs

    Person and company records for a job that has to resolve who somebody actually is first.

Run these on Oxygen's managed credits, or connect your own provider keys and pay the vendor directly — the same columns, the same runs, the same provenance either way. See every integration.

Limits

Where this stops

  • An agent is the least deterministic rung on the ladder. If you can write the steps, a workflow does it more cheaply and more predictably, and an agent is what you reach for when you genuinely cannot.
  • Platform deny rules and hard ceilings are not configurable. That is reassuring when something goes wrong and constraining when you want an agent to do something the capability catalog does not expose.
  • Triggers are a Workspace Agent capability today: the shipped specialists run on their own cadence, and a custom agent starts from a manual run rather than a schedule you set.

FAQ

Questions people ask first

Which agents actually ship today?
A general workspace worker plus four specialists: inbox reply drafting, a meeting notetaker that files notes onto records, knowledge synthesis on a cadence, and an inbound conversation tagger. The roster never lists something that does not run.
Can an agent spend without asking?
Within a ceiling you approved, yes, and that is the point of turning one on. Beyond it, no. A manual run carries an explicit cap and a trigger stores one per delivery, so standing permission is always bounded by a number.
Can I build my own?
Yes. A custom agent gets a slug, a job, an owning primitive, an approval posture, and immutable versions, running under the same enforced envelope. What you cannot do is upload a runtime and have Oxygen execute it.
What stops it sending something embarrassing?
The posture you published. Reply drafting is structurally draft-only, ask rules pause per call, and external sends keep their own preview and approval. Autonomy is granted per capability, never as a blanket setting.
How do I debug a bad run?
Open the run. It carries status, the tool calls it made, approvals it waited on, inference usage, credits drawn, and links to the artifacts it wrote, so you diagnose behavior rather than reconstruct it from output.
Is this an agent builder?
No, and the distinction is deliberate. Oxygen sells governed workers over a bounded capability catalog. If you want a framework for arbitrary agent code, this is the wrong product and we would rather say so.

Run governed agents with a budget and a run history on your own workspace

Sign up, get a working workspace with a one-time credit grant, and run the first play from the web app, the CLI, or your AI assistant over MCP.

Start freeSee pricing