AI agents that act on your business — inside limits we publish.
Six reasoning steps by default. A 6,000-token budget. A forty-five-second wall clock. Three actions per run. Hit any of those and the run stops and escalates to a person rather than inventing an answer. You decide, per agent, whether it suggests, asks permission, or acts.
Sign-up opens when the app launches. We will email you once — no marketing list.
Hard ceilings — the run ends at any one of them
Three things you can check before you trust it
Not brand promises — properties of the code. Each one is checkable in a security review, and the run panel above is a live demonstration of all three at once.
The autonomy model
A permission setting on each agent, with three named levels. The level decides what physically happens to a proposed write.
Approve is a real queue, not a notification
The approval is a durable record with the proposed action's full payload attached, and approving it is what triggers execution — the agent does not act first and ask later.
Autonomous is not a bypass
Every write, in every mode, goes through one dispatch function. There is no second, faster path that skips the checks.
Nothing is written
Reasons, reads, proposes. Logged and notified.
Queued, executes on accept
A durable record, 48-hour expiry, waiting for a person.
Dispatched immediately
Still through the same governed engine.
What an agent may never do
No Oneop agent can post to your ledger, issue a purchase order, place a credit hold or send a payment reminder unless money and stock actions are switched on separately — regardless of its autonomy mode.
The carve-out extends past the obvious cases. A task action is gated by what the task points at: create or touch a task attached to an invoice, a bill, a sales order, a purchase order or an inventory item, and it hits the same fail-closed guard. A task on a deal, contact, company, lead, ticket or customer does not.
Even with the flag on, money actions create or update draft records through the same invariant-safe service functions the human screens use. None of them post to the general ledger or mutate stock directly. Posting a bill to the GL still requires a separate, deliberate approval by a person.
A named negative capability is better proof than any positive claim: Oneop does not offer unattended finance automation, and the code is built so that we cannot accidentally ship it.
The published ceilings
Every run is bounded on four independent axes, and hitting any one of them ends the run cleanly.
There is a fifth stop that isn't a number. If two consecutive steps produce identical observations, or the model returns unparseable output twice in a row, the run terminates as no progress — loop-detection that stops an agent burning your budget re-reading the same row.
When any ceiling is reached the run is marked escalated, not completed. The stored exit reason is one of:
max_iterationsbudget_exceededtimeoutno_progress
A person picks it up from there.
Reasoning iterations
Configurable upward, with an absolute hard cap of 12 regardless of configuration.
Token budget
Per run. Checked before each step.
Wall clock
Forty-five seconds. Checked before each step.
Actions
Per run. Write actions, counted across the run.
That distinction is the entire point. An agent that hits its limit and stops is safe. An agent that hits its limit and produces a confident-sounding answer anyway is the failure mode everyone in this category is quietly shipping.
Simulated or live, and the product tells you which
Every agent run in Oneop is badged Simulated or Live, generated from the stored run record rather than chosen by whoever is presenting.
A demo trace. It makes no model call, creates zero credit-usage rows, and stores a null confidence which the interface renders as an em dash — because a run that never asked a model has no confidence score, and printing one would be a fabricated number.
The real thing: a metered ReAct loop with a real trace, a real exit reason, a real model name and a real token count. Confidence itself comes from a separate metered scoring pass in which the model rates its own answer — and it is null there too when a run failed or aborted, for the same reason: a stopped run has no meaningful confidence, and Oneop does not fill that field with the agent's configured threshold to fake a result.
We built this because "watch our AI do it" demos are usually unfalsifiable. In Oneop, a demo cannot be logged as real work, and real work cannot be mistaken for a demo.
What agents can actually do — 18 action types, by module
Agents work through a tool catalogue. Reads return real observations; writes are routed to the governed action engine. Every one of the eighteen action types passes the same dispatch guard.
Read and analyse — no side effects
- CRM contacts and deals
- Invoice and AR context
- Knowledge base
- Inventory levels
- Bank transactions
- Reconciliation match
- Public-context enrichment
- GL code suggestion
- Draft an email body
- Draft a KB article
- Draft a sales quote
Write — autonomy-gated
- Send an email
- Update a CRM contact or deal
- Update or close a support ticket
- Create, assign, complete or comment on a task
Grounding has three retrieval tiers depending on your deployment; with no vector sidecar and no embedding key configured, it is keyword matching rather than semantic search, and the index refreshes on a manual sync rather than continuously. Every read is scoped to your tenant on every tool call — tenant isolation is the platform's data-layer boundary, and the agent inherits it, not a feature the agent implements itself.
One model, one metered choke point
Oneop's agents run on Google Gemini only — gemini-2.5-flash for reasoning, gemini-2.0-flash-lite for fast paths. No multi-model routing, no GPT, no Claude. Every model call is metered through one choke point: guardrails run first, then credits are reserved, then the provider is called, so a blocked prompt is never charged. An agent action costs 5 credits; hitting a plan's cap returns a refusal — HTTP 402 — never a silent overage charge. A guard test fails the build if any agent-surface file makes a direct provider call or omits a tenant ID.
Inside the product this is called the AI Workforce — same feature, the in-product name for the agent configurator, run history and approvals queue, available on every plan including Free. Prompt-injection blocking and PII redaction run on every model call, on every plan, with no off switch, on every step of the loop — not once at the start.
Frequently asked questions
What stops it doing something stupid?
Six mechanisms, all of them code rather than policy. Guardrails run on every reasoning step and block prompt injection unconditionally. Four hard ceilings bound the run — six iterations, 6,000 tokens, forty-five seconds, three actions. A no-progress detector stops repeated identical observations. Every write is routed through one governed dispatch function that applies your autonomy mode. Money and stock actions are fail-closed behind a separate flag regardless of autonomy. And hitting any ceiling ends the run as escalated, so a person sees it — the agent never fabricates an answer to finish.
Can an agent post to my accounts or change stock?
Not unless someone deliberately switches money and stock actions on, and they are off until they do. While they are off, those actions are acknowledged and do nothing — even in autonomous mode, even after a human approves them. Switched on, they create or update draft records through the same service functions your staff use; posting a bill to the ledger still needs a separate human approval.
What does "escalated" mean on a run?
The run hit a limit and stopped cleanly rather than continuing. The stored exit reason says which one: maximum iterations, token budget exhausted, wall-clock timeout, or no progress. The full trace up to that point is kept so a person can carry on from where the agent stopped.
How is this different from the chatbot?
The chatbot follows a flow you drew — deterministic, the same input walks the same path, ideal facing the public. An agent chooses its own path within a tool set and stops at published ceilings, which suits internal operations. Most teams run both. See the chatbot page for the flow-based side of this.
Which model do the agents use?
Google Gemini exclusively — gemini-2.5-flash for reasoning and gemini-2.0-flash-lite for fast paths. There is no model choice, no multi-model routing and no GPT or Claude support anywhere in the product.
What does a run cost?
An agent action is 5 AI credits. Plans include 50, 1,000, 5,000 and 15,000 credits a month; Business plans can bring their own Google AI key and run uncapped. At the cap you get a refusal, not an overage invoice.
Can I see exactly what an agent did?
Yes. Every run stores each step's thought, chosen action and parameters, the real observation returned, tokens used and duration, plus the run's exit reason, model and total tokens. Simulated runs are badged as simulated and make no model call at all.
Can agents read another workspace's data?
No. Every tool call carries the run's tenant ID, and tenant isolation is enforced at the data layer across the platform — 275 of 329 tables are tenant-scoped. A build-breaking test also fails if any agent-surface router call omits the tenant ID.
Is the AI Workforce available on the free plan?
Yes. The AI Workforce entitlement is enabled on every plan including Free, which includes 50 AI credits a month — enough to configure an agent and watch several real runs.
Start it in suggest mode. Promote it when it earns it.
Configure an agent on the free plan, watch its full reasoning trace, and decide for yourself. No credit card.
Sign-up opens when the app launches. We will email you once — no marketing list.