The control system around every AI agent.
Quick builds put the rules in a prompt and hope. We put them in the engine: what an AI agent may do is declared, checked before it goes live, guarded on every action and recorded. The model holds the conversation; the engine decides what happens.
Declared, checked, guarded, recorded.
Declared
What each AI agent may do is written down as capabilities, not left to a prompt.
- Who may use it, on which channels
- Which records it reads and which it changes
- Money as typed values, never free text
- Every possible outcome, with approved words
Checked
A capability cannot go live until the engine has checked it.
- Every change has a read-back
- Money, roles and outcomes are complete
- Every value has a known source
- Each channel’s real limits are respected
Guarded
At run time the engine, not the model, decides what happens.
- The person is proved before their data is shown
- Permission is checked before every action
- Nothing changes without a yes to an exact read-back
- Tokens never reach your systems
Recorded
Every action leaves a record you can show anyone.
- Who asked, and for whom
- What was shown and confirmed
- What actually happened, with the provider’s confirmation
- Secrets kept out of records and logs
What happens when it goes wrong.
Pick a failure. Each is a moment where a quick build does the wrong thing, and each names the mechanism that handles it.
The payment times out halfway
Retries and charges twice, or loses the order.
Resumes from the last completed step and charges once.
How: Durable workflows on Temporal, idempotent steps and provider event deduplication.
One booking, followed through every control.
A table for four with a $20 deposit, from the first message to the record, with what the engine produces at each step.
inbound whatsapp from +44 7700 900123 signature verified with the provider text "Table for four tonight at 8?"
Simplified for reading. Names and values are examples.
Write a conversation once. Serve it properly everywhere.
Every capability is described in our own channel-independent interaction language: who takes part, the steps they go through, what each step shows, asks and changes, and every possible outcome. The runtime then serves it on each channel in the form that channel supports.
// Simplified for illustration interaction('reserve-item', { roles: ['customer'], steps: [ inform('availability', { facts: source('stock') }), choose('size', { from: source('variants') }), confirm('reserve', { effect: 'orders.reserve' }), outcome({ success, pending, conflict, rejected, unknown }), ], })
Example conversations. One platform, every channel.
Each step takes the form each channel does best.
| Channel | Show facts | Offer a choice | Confirm an action | Card or identity details |
|---|---|---|---|---|
| Website chat | Native | Native | Native | Secure page |
| Native | Native | Native | Secure page | |
| Native | Adapted | Adapted | Secure page | |
| SMS | Adapted | Adapted | Adapted | Secure page |
| ChatGPT and Claude | Native | Native | Native | Secure page |
| Slack, Microsoft Teams, Google Chat | Native | Native | Native | Secure page |
| Voice | Adapted | Adapted | Adapted | Secure page |
What the AI agent says is written before anything runs.
Every action declares its possible results, and each has approved words. The AI agent never announces a success the system has not confirmed.
“Your table for four is booked for 8:00 pm on Friday.”
“Your payment is being processed. I will confirm as soon as the bank does.”
“That time was just taken. 8:30 pm is free. Shall I book it instead?”
“The card was declined. Nothing was charged and nothing was booked.”
“We could not confirm the booking yet. I am checking and will message you shortly.”
Durable waits and follow-ups
A step can wait for a payment, an approval or an event for up to 90 days, then carry on. A change that ended unknown is checked, not repeated. Built on Temporal.
Secure pages for sensitive steps
Card numbers, documents and identity checks move to a protected page and come back to the conversation, so they never sit in a chat.
Confirmed changes
Each step can change at most one thing, through a registered operation with checked inputs, and only after a yes.
One build, every assistant platform
Capabilities are written in TypeScript and compiled into one runtime artifact that serves both current MCP protocol versions, including apps in ChatGPT and Claude.
A broker for credentials
Each person’s access is exchanged for narrow, delegated credentials for each system. Tokens an AI agent presents never reach your backend.
An open runtime
Noodle Core, our runtime for AI agents and the tools they use, is open source under Apache-2.0.
Tell us what you need. We will suggest where to start.
Any layer, any size: a review, a project, a programme or a partnership.