For teams running agents in production · self-hostable

You've hired agents.
We provide their HR.

Every other tool just watches your agents work and charts what broke. Taksham runs the whole employment — an identity and scoped permissions for each one, live supervision in the critical path, per-agent cost, and a loop that turns every failure into a gate the same mistake can't slip past twice.

Day one

A new agent clocks in — eager, and wearing pay:* like it's nothing.

22 control surfaces~24 first-party engines1 spine5 pillar bands0 lock-in

scroll to play ↓

HR for your agents

You've hired a workforce that never sleeps. Nobody's managing it.

ChatGPT and Claude are tools for your people — and they're great. But you're not just hiring people anymore. You've got agents in production that decide and act on their own: answering customers, touching data, spending money. That's a new kind of employee, and right now no one actually manages them.

Taksham is that management layer. Think of it as HR for your agents — every job an HR department does for your humans, Taksham does for your agents. You run your people; we run your agents.

  • Hiring & badges

    An identity and scoped, expiring permissions for every agent.

    Identity
  • Performance reviews

    Evals and scorecards — is the work good, is quality slipping?

    Evals
  • Catch it in the act

    A live semantic firewall, a kill-switch, and one-click revoke.

    Firewall
  • Never make that mistake twice

    Every incident becomes a permanent regression test.

    Loop
  • Payroll & expenses

    Per-agent cost attribution, budgets, and cheaper routing.

    Optimize
  • Compliance & the paper trail

    Approvals, policy, and an audit log produced just by running.

    Govern
  • The personnel file

    What each agent knows and remembers across sessions.

    Memory
01The problem

You bought eight tools. You still can't answer one question.

Tracing in one vendor. Evals in another. A gateway, a guardrail, a red-team script, a finops dashboard — each with its own store, its own IDs, its own version of the truth. When an agent burns $40 and ships a refund it shouldn't have, you stitch five exports together by hand and still guess.

The data that would explain the failure exists. It's just scattered across products that were never meant to agree. So nothing is replayable, nothing is provable, and the same incident happens twice.

Taksham collapses the pile into a single substrate. One spine. Every answer.

02One spine. Every answer.

Every trace, decision, and dollar — on one immutable, replayable spine.

Spans, decisions, and embeddings land append-only in a single store. Nothing is ever mutated, so any run replays byte-for-byte — the model call, the tool result, the guardrail verdict, the cost. Decisions are first-class rows, not log lines, so "why did it deny this?" has an answer, not a theory.

  • Spans + decisions + embeddings, one schema, one tenant stamp
  • Faithful replay — reconstruct any run to any offset
  • Semantic search over runs via cosine kNN on embeddings
  • DuckDB embedded for local · ClickHouse for scale — same SpQL
SpQL · one query, every surfaceread-only
-- last 24h: agents that denied a payment, with cost
SELECT agent, count(*) deigns, sum(cost_usd) burn
FROM spans JOIN decisions USING (trace_id)
WHERE decision.verdict = 'DENY'
  AND decision.policy LIKE 'payments.%'
  AND ts > now() - interval '24h'
GROUP BY agent ORDER BY burn DESC;

The same query runs against the embedded store on your laptop and the columnar store in prod. No re-instrumentation, no second pipeline.

Flight recorder · scrub any runreplay, not logs
trace 7f3a92c1checkout-agent
DENYguardrail.payments.cap
MINTfailing testGATECIPRblocked
spans 1decisions 0$0.00
A Taksham replay: the checkout agent plans with an LLM, calls inventory (200) then a payments wire that fails 502; the payments guardrail denies the wire, the incident is minted into a failing test, wired into a CI gate, and the pull request that would re-ship the bug is blocked. The run totals 14 spans, 3 decisions, and $0.84.
03Incidents become tests. Automatically.

The failure you debug today becomes the test that blocks it forever.

Most platforms tell you something broke. Taksham closes the loop: an incident on the spine is detected, minted into a failing eval drawn straight from the trace, and wired into a statistical CI gate. The pull request that would re-ship the bug doesn't merge. Reliability stops being a vibe and becomes a ratchet.

01 DETECTincident lands on the spine02 MINTfailing test, from the trace03 GATEstatistical CI gate04 SHIPfix merges · test passesWelch's t / two-proportion z vs trailing baselineBLOCKEDthe PR that would re-ship it →the loopevery incident becomes a permanent test
04One control plane · 22 surfaces

Twenty-two surfaces. One login. All reading the same spine.

Traces

01

Faithful replay, full-text search, multimodal span detail.

Observe

02

Dashboards, monitors, debug copilot, classic-ML XAI, taint paths.

Gateway

03

OpenAI-compatible proxy, routing, virtual keys, MCP reputation.

Evals

04

Datasets, scorers, review insights, GitHub prompt sync, spreadsheet IDE.

Loop

05

Incident → replay → regression test, plus trace-driven auto-improve.

Verify

06

SBOM, dependency risk, reachability, model-weight scan.

Copilot

07

Debug traces, drive evals, mint tests from incidents.

Authoring

08

Visual graph canvas, NL→graph, durable agent blueprints.

Govern

09

Approvals, policies, OAuth AS, auth-flow builder, secretless mint.

Compliance

10

EU AI Act risk-tiering, ISO 42001, bias/fairness audits.

Security

11

Red-team campaigns, signed Trust-Score, recon, posture scoring.

Firewall

12

Bidirectional scanners, DLP, /v1/guard drop-in, runtime egress.

Discovery

13

Shadow-AI discovery, identity-graph blast-radius, 101+ posture rules.

Platform

14

Self-observability — Taksham, watching Taksham.

Runtime

15

Durable workflows, flow control, and a microVM driver with guest-kernel + rootfs isolation (no silent fallback).

Optimize

16

FinOps, router leaderboard, custom predictors, feedback improvement.

Memory

17

Episodic + semantic recall, criteria retrieval, temporal KG audit.

Data

18

Offline-first sync, authz partial replication, CRDT.

Browser

19

Act / extract / observe, record-and-replay.

Train

20

Gymnasium RL env, incident→RL wire, trajectory export.

Voice

21

WER/CER, latency, barge-in, realtime callers.

Swarm

22

Call-graph topology, per-agent cost & blast radius, first-party A2A protobuf wire.

05We didn't integrate the hard parts. We built them.

Owned, not glued.

The pieces that decide whether agents are trustworthy — the durable engine, agent identity, the gateway, the eval runner, the incident-to-test loop — are first-party Taksham code reading first-party data. We integrate model APIs, browser and OS drivers, and the database substrate. Everything that constitutes the moat, we built.

Taksham — Sanskrit, the one who carves. We didn't assemble a platform from other people's primitives. We cut it. Named for the carpenter. Built like one.

  • Durable workflow engine

    Deterministic replay, signals, schedules, flow control, workflow depth panels.

  • Agent identity & authz

    Durable OAuth authorization-server (DCR), visual auth-flow builder, secretless credential mint preview.

  • Visual agent authoring

    A reactflow graph canvas with NL→graph — blueprints save and persist (durable agent-graph registry), then run on the workflow engine.

  • LLM gateway

    OpenAI-compatible proxy, 400+ model catalog, MCP reputation, batch/passthrough APIs.

  • Eval engine

    Composable scorers, review insights, GitHub prompt sync, distribution-gate experiments.

  • Incident-to-test loop

    Detect → real-LLM-grounded diagnosis → mint → gate → auto-improve (scorer, dataset, prompt) on the live spine.

  • Semantic firewall

    Bidirectional scanners, DLP, /v1/guard drop-in, and an inline sub-50 ms detector tier with a deterministic latency-budget degradation ladder.

  • Supply-chain signing

    Real Ed25519 DSSE envelopes + in-toto SLSA provenance over SBOMs — a genuine signature, verified, not a placeholder.

  • Learned-model defaults

    Injection, eval-judge, the red-team attack-success judge, and the memory embedder run real learned students out of the box (the embedder is auto-fetched from Hugging Face on first use when network egress allows) — heuristics are the floor, not the ceiling.

06Govern & secure

Provable control, because the evidence is already on the spine.

Every guardrail verdict, approval, payment reservation, and policy decision is a row, not an afterthought. Compliance evidence isn't generated for the audit — it's the byproduct of the system running. Red-team campaigns attack your live agents through the same gateway, scored by a learned attack-success judge, and feed findings back to the firewall.

SSO / SAMLOAuth AS + DCRMCP reputationNHI perm→data blast-radiusKnowledge-DLP oversharing simLearned attack-judgeDSSE / in-toto SLSAApproval gatesPII / DLPTrust-Score exportAct-chain audit
07Cloud or self-host

Managed Cloud or self-host — same first-party stack. Zero lock-in is a setting, not a promise.

Run it as a managed Cloud, or self-host the whole thing — same code, same spine. The hosted tier enforces per-tenant isolation (a tenant can't read, route, or spend against another) with a partitioned cache and regional failover; self-host stays first-class for regulated buyers. Self-hosted, the spine is yours — DuckDB on a laptop or ClickHouse in your VPC, shipped with Docker Compose, Helm, or Terraform, and your traces never leave your perimeter unless you decide they should.

Docker Compose
Helm chart
Terraform
08Up in under a minute

Clone it. Run it. Open the spine.

No account, no credit card, no cloud. The full control plane boots on a seeded spine so every one of the 22 surfaces is live the moment the dev server is up. Point your own traffic at it via the SDK or OTLP when you're ready.

terminal~/taksham
# clone the monorepo
git clone https://github.com/utkarshparcel/taksham
cd taksham

# install the workspace (pnpm + turbo)
pnpm install

# boot the control plane on the seeded spine
pnpm dev

→ control plane http://localhost:3000
From the same team · hanu.taksham.org

Taksham manages the agents. Hanu watches the estate they run on.

An agent with a badge and a budget still runs on your cloud, your identity provider, your CI, your model endpoints. Hanu is our self-hosted security platform for exactly that surface — it correlates signals across all of them into compound attack chains, with the evidence attached, so a GitHub action, a certificate issued last month and a Bedrock call this afternoon land in one risk instead of three dashboards.

Same posture as Taksham: your datastores, your keys, no control plane phoning home. Community edition is free in production.

  • Correlation, not another scanner

    75 correlation rules across two tiers join signals that are only dangerous together.

  • 609 detections, 96 ATT&CK techniques

    Deterministic rules over typed signals — no LLM in the detection path, so a score is reproducible six months later.

  • Cloud, identity, supply chain, AI

    AWS, Azure, GCP and Kubernetes in depth; Okta and Entra ID; GitHub, GitLab and CI; model and agent surfaces.

  • Closes where the work happens

    A fix goes back as a check run or a pull request, not a console ticket nobody opens.

The end of the apology

Stop apologizing for your agents.

Give every agent an identity, a reviewer, and a gate it can't slip past — then let Taksham run the rest.