the Bloodstream.
The channel. Every cell acts through one governed tool layer, and a bad call gets refused, on the record.
the unwatched write
38%
monitor AI traffic end-to-end
Only 38% of organizations monitor AI traffic end-to-end, across prompts, tool calls, and outputs. Nearly 20% have no controls at all, with no monitoring, guardrails, or enforcement.
Your AI is acting on your systems, and most teams are not watching it end to end.
Give an agent access and it pokes your databases and APIs directly, writing rows, calling services, and changing records with nothing checking the action on the way through. A bad call just happens, and by the time anyone notices, it has already landed.
where today falls short
A tool call is not a checkpoint.
Today an agent reaches straight into a database or an API and writes, and nothing inspects the call in transit. A malformed write lands and corrupts the shape, an unpermitted write lands because nothing said no, and the ones that should have been stopped leave no record that they were ever tried. Checks that live in each caller are checks that get skipped. They have to live in the path itself.
The circulation
Everything flows through one channel.
Every write the cells make travels one governed channel, checked, gated, and recorded on the way through. Nothing reaches the organism's state unseen. The diagram below shows a write passing the gates.
the answer
One governed channel. Every write is checked in transit, then committed or refused.
Every action a cell takes flows through one governed layer. A write is not a direct poke at the database; it is a typed call that gets shape-checked, then permission-checked, then state-checked against the record itself, before it is allowed to commit. A valid write lands as a durable, audited row. An illegal write is refused, and the typed refusal names the exact corrective call to fix it. The bus cannot write bad state, and it tells you how to recover from a rejected write.
what this teachesEvery action a cell takes is checked on the way through. If it is refused, the error names exactly how to fix it.
more than a tool call
What a governed bus has that a direct write doesn't.
A direct write is a poke into the void. A governed write goes through one channel, is checked before it lands, and if it is refused it tells you exactly how to fix it.
One governed channel.
!Today A lone agent wires straight into each system, and every direct integration is its own unwatched risk.
the cell Every action goes through one bus, made of typed tools on three governed servers. One place every write has to pass, not a tangle of direct pokes.
Checked in transit.
!Today A lone agent writes first and you find out later, if the bad value is ever noticed at all.
the cell Shape is checked first (a typed schema), then permission (a policy), then state legality against the database itself (checks, row-level securityA rule the database engine enforces itself on every read and write. It filters which rows each person can see and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right., triggers), all before the write is allowed to commit.
A refusal that names its own fix.
!Today A lone agent hits an error and gets a stack trace, and has to guess what to do next.
the cell A rejected write comes back with a refusal code, the reason, a doc reference, and the exact call that will fix it.
from our own systems
The governed bus, enforcing today
These numbers come from the running action bus. Hundreds of typed tools sit across three servers, and every write is inspected in transit by database checks, row-level securityA rule the database engine enforces itself on every read and write. It filters which rows each person can see and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right., and triggers. Each typed refusal class names the corrective call that recovers a rejected write.
KeyA green value is real, from our own database, as of Oct 8, 2026; in the diagrams, green marks a committed write.
enforcing today
364A real count from the platform's own source tree, shown as proof rather than a claim. It is a dated snapshot, captured Oct 8, 2026.
governed tools that cannot write bad state
- The core server writes the typed record itself. Tasks, decisions, messages and the rest of the coordination store go through these tools.
- These tools reach the machines the organism runs on, from containers and hosts to networks and the game platform.
- The client server holds tools scoped to client work, kept off the two servers above.
a real count from the platform's own source tree, as of Oct 8, 2026
on the action bus
3
governed servers
- core
- infra
- client
at the gate
6A real count from our own database, shown as proof rather than a claim. It is a dated snapshot, captured Oct 8, 2026.
approval policies
changes a human must approve before they run
zoom in
Down to a single refused write
One typed call, checked for shape, then permission, then state, refused at the last mile by the storage engine because its state was illegal, and handed back as a structured error naming the exact tool to fix it. That refused call is the smallest unit of the bloodstream.
Curious how a layer like this would fit your own records?