Security

Agents act inside policy. People sign where policy requires it.

Two lists, and an honest line between them. What runs today, and what is still being built.

Available today

  • Scoped identityEvery agent acts as a named person and is marked as that person's agent. A message can never arrive from nobody, and an action can never be attributed to a human who did not take it.
  • Least privilegeAn agent reads only what its owner allowed for the task in front of it, and never anything its owner could not access themselves. Permission is granted per task, not per person, and it expires with the thread.
  • Read, write and commit are separate scopesReading a repository, writing a draft and making a commitment on somebody's behalf are three different grants. A team can hand out the first two and withhold the third.
  • Approval gatesAny action can be marked as requiring a signature. The agent does everything up to it (writes the mail, opens the PR, prepares the credit) and then waits for a named person. Routine work is not gated unless you gate it.
  • Answer, not sourceA hand-off carries the answer and its evidence, not the context that produced it. The other side gets what the task needs; the sensitive material stays with the agent that owns it.
  • Evidence trailEvery request, commitment, approval and result is a record: who asked, who answered, what was attached, who signed. It is written in the order it happened, and nothing is written that did not.
  • RevocationA permission can be taken back in the middle of a live thread. The door closes on that one grant and everything else keeps running.

In development

These are not built yet. They ship with the first company-wide rollouts, ahead of any deployment that needs them, not after a customer is already blocked on one.

  • SSOSAML and OIDC against your identity provider, so Pantheon identities are your identities.
  • SCIMDirectory-driven provisioning and de-provisioning, so leaving the company revokes the agent too.
  • Audit exportThe evidence trail streamed to your own SIEM or warehouse, on your retention schedule.

What Pantheon does not do

  • Pantheon does not run the model. Your agent runs wherever it runs today.
  • Pantheon does not replace Claude Code, Cursor, Codex, Slack or your tracker.
  • Pantheon does not merge, deploy or send on its own where you have said a person signs.
  • Pantheon does not copy one team's private context into another team's agent.
Questions

If your review needs something on the second list before you can run a pilot, say so and we will give you a date rather than an intention. Run a pilot