graal Agentic Platform
Your AI agents move your processes forward.Under measured guarantees.
Software delivery, IT operations, joiners and leavers, data changes: workflows carried by agents and people. Every guarantee is a check the platform runs itself, and every write to a third-party system waits for a person’s approval by default. Open source, under the Apache 2.0 license, on your infrastructure.
Agent workflows
Processes carried by agents and by people
A workflow is a set of states you write. Each transition says who acts — an agent, a person or the platform —, what it produces and which guarantees must hold before it goes through. The same engine carries four families of processes.
Software delivery
A ticket becomes a specification, tested and reviewed code, then a production release. Agents specify, implement and review; people approve; the release train ships it.
IT operations
An operations finding becomes a planned, approved, applied and verified change. The agent investigates and proposes; a person decides; the platform applies and measures.
Joiners and leavers
Account, groups, laptop, badge. An agent prepares the access plan, HR approves it, every write goes out on its date — and is undone at departure.
Data changes
An agent proposes a change to your data. It goes through guarantees and human approval before the Data Platform applies it.
States, transitions, actors
An agent (a role, a model, a budget), a person (a group, a deadline, a reminder, an escalation) or the platform, which performs an action itself, with no agent and no cost.
Valid as soon as it is written
An unreachable state, an endless retry loop, an unknown guarantee or one with nothing to check: the workflow is refused when written, not halfway through a ticket.
Visual editor and YAML
The map, the step-by-step view and the YAML edit the same draft. Every version is kept, comparable and restorable.
Several workflows per project
Onboarding and offboarding in one project: each ticket is born in the workflow the routing names and stays on its version.
Your issue tracker stays the interface
GitHub, GitLab or Jira — or the built-in tracker, for work that exists nowhere else. The platform writes state, cost and evidence back to it.
Tasks for people
A person also receives tasks: a form to fill in and a sentence to attest, such as handing over a badge.
Any agent
Claude Code, Codex, Gemini CLI, Goose, OpenCode… behind one protocol
The platform drives each agent through ACP, an open protocol. The workflow names a role, not a product: you change agents without rewriting the process.
Source : ACP protocol repository, Apache 2.0 license (accessed on 19/10/2026)
An agent registry
Internal (the platform runs them) or external (they connect). Each agent has versions that never change, an owner, a budget, an expiry date, and can be revoked in one move.
Ready-made agents
A catalog of agents, one per role: triage, specify, develop, test, review, verify production. You install them, then adapt them.
Skills
A library of skills that agents carry. Imported from a repository at a pinned commit, scanned before use, held for a second person when they carry risk. A skill declares no permission.
An MCP door for Claude and the rest
Claude, or any MCP client, connects with a scoped token or through your SSO: it opens tickets, follows their progress and sees the decisions waiting. It takes none.
Rights that intersect
An agent acting for a person can do neither more than the agent is allowed to do, nor more than the person can do.
Every agent is measured
Runs, success rate, cost by kind and by project, today’s spend: an agent’s page says what it does and what it costs.
Guarantees and approvals
Guarantees that refuse, a person who decides
A guarantee is a check the platform runs, never an instruction written in a prompt. When it fails, the transition does not go through.
Tests actually run
The platform runs the repository’s tests itself and overwrites what the agent declares.
Change scope respected
Modified files stay within the allowed paths; whatever falls outside is reverted.
No secret
The content of the change is scanned: a secret found blocks the transition.
Scans
The security checks of your continuous integration pass.
Review approved
The review’s verdict is read, not inferred: a review that asks for changes blocks the step.
Signed provenance
The build provenance is signed before release.
Measured business facts
A number that matters is measured by the platform or computed by a deterministic step; every quoted value must be found in the sources.
Output schema
Every deliverable matches the schema you wrote in the workflow.
Human approval
Every write to a third-party system waits for a person
Create an account, order a laptop, deactivate a badge, open a change: a write is a governed action. It waits for a decision unless you have allowed the operation.
01
The agent proposes
The proposal carries its identity, its parameters and its compensations. Nothing is written.
02
A different person decides
Neither the proposer nor the agent’s owner. They authenticate again at the moment of deciding, and two distinct approvers can be required.
03
The platform runs it, once
Each effect is recorded before it is attempted: an effect that is done is never done twice, and a failure triggers, in reverse, the compensations for what had been done.
Models, tools and budgets
The model of your choice, every call counted
Agents call the model through a gateway you run: hosted on your premises or at a provider, it changes without the workflow changing.
A capped key per run
Every run gets its own key, capped at what is left of the budget and revoked when the run ends, however it ends.
A cost ledger
Every model call and every tool call is in it, with its project, ticket, step and agent. CSV export.
Budgets that nest
Per step, per ticket, per project and per day. A budget given at launch can only tighten the others, never widen them.
Budget spent: a person decides
The step stops, it is never retried on its own, and the ticket waits for a decision. Adding budget is a decision, recorded in the log with its author.
A tool catalog kept like code
The third-party APIs and MCP servers your agents may call are declared in a file reviewed like code. The agent never holds a credential: it only sees the names you chose, and the platform calls on its behalf, with the provider’s key. A discovered tool is born closed.
A disposable sandbox
Every run has its own workspace, a short-lived token and a network closed by default: egress goes through a relay whose list you write. The agent’s container holds no lasting third-party credential: only short-lived tokens, valid for the duration of the run.
Evidence and audit
What the agent did, measured by the platform
What the platform displays comes from what it observed, not from the agent’s account. Every signal says where it comes from: declared by the agent, observed by the platform, or inferred.
Measured evidence
Tests run, quality, size of the change, business facts: a step the agent calls finished is only shown as done once the guarantees have passed.
An audit log
Who proposed, who decided, how recently that person had authenticated, and every effect applied, key by key. Exportable as CSV.
Cost per ticket
From specification to production, what each ticket cost, step by step.
Delivery indicators
Deployment frequency, lead time, failure rate, time to restore: the four measures, per project.
A finding rather than a silent fix
An agent that sees a problem outside its scope reports it. The finding is deduplicated, triaged, then linked to a new ticket.
Production under control
One deployment at a time, under control
Changes that are ready are batched into a release train. The merge queue, the train and the sync windows of your GitOps tool are three independent locks: a change reaches production only within the rules.
The release train
It batches what is ready, opens its window, requires its approval, deploys in steps and rolls back if health degrades.
The express lane
An urgent fix leaves at once, with a shorter soak, under its own approval.
The freeze, with a reason
A frozen train requires a reason, and a rollback freezes it on its own: nobody retries by reflex.
With the Data Platform
Independent, and complementary
graal Data Platform and graal Agentic Platform can each be installed, used and bought on their own. Together, they complement each other in three ways.
01
The Agentic Platform’s agents operate the Data Platform through its MCP server, under a service account limited to one project; every call is traced on both sides.
02
A data change proposed by an agent is governed end to end: branch, guarantees (tests run, data quality on a sample, measured facts), human approval, application through the Data Platform’s API, evidence attached to the ticket.
03
One shared foundation: the company’s SSO (OIDC, SAML, LDAP), the same audit conventions, the same installation (Helm, no cluster-admin rights, restricted pods), on your infrastructure.
Deployment
On your side, with a Helm chart
The Agentic Platform installs on your Kubernetes with a Helm chart, without cluster-admin rights. The platform, its agents and its data run in your infrastructure; the model is the one you choose.
A Helm chart
The components run unprivileged in your cluster. You plug in your PostgreSQL database, your OIDC identity provider, your object storage and your model gateway; for a trial, the chart can bring its own database and gateway.
A trial under Docker
One command starts the platform on a workstation, with simulated agents until you provide a model key. You see the workflow, the guarantees and the approval before installing anything.
Your infrastructure
On premises, in a private cloud or with the hosting provider of your choice. You plug in your SSO, your issue tracker and your code repository.
Open source, Apache 2.0
The code is open, under the Apache 2.0 license: you read it, install it and adapt it. The publisher offers a subscription — support, security fixes, qualified updates, signed images — and graal Services.
Frequently asked questions
Which agents can I use?
Claude Code, Codex, Gemini CLI, Goose, OpenCode, and any agent that speaks ACP. The workflow names a role, not a product: you change agents without rewriting it, and every agent goes through the same guarantees.
Which model does the platform use?
The one you choose, hosted on your premises or at a provider, behind the platform’s gateway. Every run gets a capped key, and every call enters the cost ledger.
Can an agent write to production?
Not alone. By default, every write to a third-party system is a governed action: the agent proposes it, a different person decides it after authenticating again, then the platform runs it. You can allow an operation to run without waiting; a code change reaches production only through the release train.
What happens when the budget is spent?
The run stops, it is not retried on its own, and the ticket waits for a person. Granting more budget is a decision, recorded in the audit log with its author.
Do we need the Data Platform?
No. The two platforms are independent: the Agentic Platform also carries processes with no data, such as joiners and leavers, operations or software delivery. With the Data Platform, your agents also operate data, under the same guarantees.
Which license?
Open source, under the Apache 2.0 license. The publisher’s subscription brings support, security fixes, qualified updates and signed images, with unlimited users and agents and no usage-based billing.
Watch your agents move a process forward
A demonstration on your own case: the workflow, the guarantees that refuse, human approval and the cost of every ticket.