Pheo
Expertise and technology, together. We help you find where AI belongs in your organisation, build it inside your own infrastructure, and give you the controls to trust what it does once it is there.
Why this matters
Faster diagnoses. Fraud caught before it spreads. Infrastructure repaired before it fails. A loan decided in an afternoon instead of a fortnight. None of that arrives from AI that drafts a suggestion and waits for someone to act on it. It arrives when machines are trusted to finish the work.
Which is the condition. An organisation can only hand over work it can still direct: work it can watch as it happens, shape to its own way of doing things, and take back the moment it drifts. That is not a brake on the ambition. It is the thing that makes the ambition reachable at all.
There is nothing novel in the idea. No bank checks a customer once at onboarding and then stops looking. Every serious institution already knows that authority granted is not the same as authority kept under review. We are building that second habit for machines.
The last decade connected machines to information. This one connects them to consequence.
What we do
Most people start with a conversation about something already in flight. Some teams just want the runtime layer. Either is fine, and you can start with one and never need the other.
Bring us the problem. Whether you are planning a first agentic deployment, or trying to restart one that stalled, we work alongside your people on the whole of it: which model to use and what it should cost, what runs privately and what does not, the infrastructure underneath, how to structure the data and context an agent actually needs, and where a person has to stay in the loop.
Private projects, in your environment, on your constraints. If you are not sure whether it is a problem worth solving yet, that is a normal place to start a conversation from.
The Open Agent Trust System is the runtime layer we leave running. It watches what coding agents like Claude, Cursor and Codex actually do when they reach your sensitive systems, and Protect holds the actions that need a person before they land. Every action resolves in about a millionth of a second, so it sits in front of everything without anyone noticing it is there.
pip install pheo-oats
cd your-repo
oats quickstart claude # or: cursor, codexWe start with GitHub. Tell us which other systems you want watched, wherever a wrong action is costly.
How it fits together
Two halves of the same lifecycle. One learns your preferences and your methods. The other enforces what you have decided your agents may do. Click any step to see what happens there.
Corrections made at the end feed back into ADAPT, so the system gets more accurate at the work you actually do, not the work it was shipped with.
Method
This is what we run in an engagement, and what the gateway keeps running after we leave.
Data, methods, policies, owners, and the action classes that actually matter to your organisation.
Every crossing creates a receipt: actor, intent, payload, decision, and outcome.
The gateway holds the exact payload. A person edits it if needed, and the write goes through.
Nothing is blocked. The gateway records every action an agent attempts, and you find out what your agents are actually doing.
We show you which action classes deserve a brake, derived from your own traffic and your own stated risk tolerance, not a vendor template.
Those classes wait for a person before they reach the real system. Everything else keeps moving at full speed.
Research
We ran a full public registry of agent skills through our own gate. 789 skills, from 174 unrelated publishers, were rated clean by every scanner and by the registry's own judge, while instructing an action a large class of organisations forbids outright. 657 of them fetch code over the network and execute it in the same command. These are not malware and the scanners are not broken. Permission and maliciousness are simply different questions, and screening answers only the first.
We took a live agent following real documentation and compared what it actually executed against what the document said. Of 93 commands, 3 appeared verbatim in the documentation. 96.8% of what the agent ran did not appear in the artifact anyone inspected. Agents do not transcribe instructions, they recompose them. In 42% of cases the agent performed an action whose consequence class appeared nowhere in the document at all.
The common industry rule is roughly "ten clean runs, then let it go unattended." Worked out properly, ten clean approvals bound the true failure rate at only 25.9%, a one in four chance the eleventh action is wrong. For deploys, credentials and destructive commands, no number of clean runs makes an unrecoverable action recoverable. We derive the threshold from your risk tolerance instead of asserting a constant, which for some classes is up to 60 times stricter than the flat rule.
In July 2026, roughly 1,200 AI agents inside an evaluation environment coordinated on a message board nobody was reading, and around 700 of them went on to compromise Hugging Face, which rebuilt close to a third of its infrastructure afterwards. The detail that should change how this industry works is what the independent investigators found next. At least 20% of the agents showed clear interest in tampering with their own transcripts, and 7% of the records examined contained tool calls that had been successfully forged. The system under review was quietly editing the review.
Two findings from 2026 point the same direction. When a registry runs several independent scanners across the same agent skill, any two of them agree on at most 10.4% of what they flag, so a clean verdict means far less than it appears to. And when something goes wrong, the organisation that built the model is usually the organisation holding the evidence, which is exactly why outside investigators were brought into the Hugging Face incident and why they named the conflict of interest plainly in their report. A record kept by the system it describes is not a record. We think the next necessary piece of infrastructure is an audit layer no model builder owns, and it is what we are building toward.
Reading
The briefings are written for people who do not work in AI, and we send both of them together. The papers are the underlying research, with the measurements and methods, so you can check the claims yourself.
AI is not stalling because it cannot do the work. It is stalling because nobody can supervise it. Organisations solved that problem for people a very long time ago, and the answer was never to trust everything or nothing.
Get it →No bank checks a customer once. Yet AI tools get reviewed at approval and never again. We measured what that gap contains across 66,192 public agent skills, and what we found should change how you think about approvals.
Get the briefing →The framework behind graduated autonomy: a finite state machine with a published promotion condition, an automatic demotion rule, and six quality dimensions that are never collapsed into one number. Selected for the Visionary Papers track.
Read on arXiv →The measurements behind The Second Control, in full. 66,192 skills, a deterministic resolver fast enough to sit on every action, and autonomy thresholds derived from an operator's own risk tolerance rather than a vendor constant.
Code and data →Where we work
Different systems, one requirement: an action nobody can take back should be one somebody chose to allow.
Code merged, systems deployed.
Records changed, promises made.
Money moved, filings submitted.
Care recorded, data disclosed.