Your agents are built. Now get them into production.
CreateOS Studio is the governed layer under the tools you already build with. Deploy, isolate, monitor and audit every agent, in our cloud, your VPC, or on-premise.
Running agents that write code? Try CreateOS Sandbox
Dashboard
Create agentWelcome back
24
6
1,284
37
Recent agents
View all
- Support TriageText · GPT-4oReady
- Contract ReviewJSON · ClaudeReady
- Invoice ExtractionFile · GPT-4oDraft
- Policy AnswersText · ClaudeReady
Recent activity
- Guardrail blocked an off-topic reply on Support Triagejust now
- Policy Library indexed 12 new files7m ago
- Contract Review published to Slack14m ago
- Role updated: Member to Editor21m ago
- ISO 27001 certified
- SOC 2 Type II
- Zero data retention
- Sovereign infrastructure
Programs and technology partners
Trusted by
An agent reaches production when security can see what it knows, what it can touch, and what it did.
Grounded. Answers come from your documents, with the source cited.
Connected. Agents act in the tools your teams already use, one action at a time.
Permitted. Roles, sharing and guardrails decide what each agent may do.
Recorded. Every model call, search and tool call lands in the trace.
Every agent goes through the same five stages
Bring an agent you already have, or set one up in Studio. Either way it reaches production with its knowledge, its limits and a record of its work.
Its goal and instructions, the skills your team already wrote, and the model it runs on.
Read the Define docsAgent Hub/Support Triage
Name *
Goal *
Instructions *
Write a message...
Workflows teams bring to Studio
Every pattern below is documented step by step, with the knowledge, tools and guardrails it uses.
- Operations
Support triage
Classifies each support email, rates urgency and drafts a first reply for a human to send.
- Knows
- Product docs, SLA policy
- Uses
- GmailSlack
- Operations
Internal helpdesk
Answers IT, HR and facilities questions. Each employee signs in, so they only reach their own record.
- Knows
- Handbook, IT policy
- Uses
- SlackSAP SuccessFactors
- Operations
Procurement intake
Checks a purchase request against policy and returns the route, the approver and any blockers.
- Knows
- Approved vendors, authority matrix
- Uses
- No tools. Read only by design.
Settings/Audit log
| Time | Actor | Action | Outcome |
|---|---|---|---|
| Oct 21, 16:34 | Workspace admin | Published agentSupport Triage | Allowed |
| Oct 21, 16:12 | Support Triage | Guardrail blockOutput | Refused |
| Oct 21, 15:58 | Ops lead | Updated agentContract Review | Allowed |
| Oct 21, 13:00 | Workspace admin | Created knowledge baseSupport Docs | Allowed |
| Oct 21, 12:44 | Analyst | Opened traceRun 01a05c… | Allowed |
Every step on the record. Each run is split into steps: a model call, a document search, a tool call, a guardrail check. Your risk team can read every one.
Your data stays in your organization
Every read and write is scoped to your organization, document search included.
Refusals are logged too
Sensitive actions go to the audit log, including the ones a guardrail blocked.
Credentials are never shown back
API keys and OAuth tokens are encrypted and never returned by the API or the UI.
Access is checked twice
A role decides what you can create. A per-agent permission decides what you can reach.
- ISO 27001 certified
- SOC 2 Type II
- Zero data retention
- Sovereign infrastructure
Any model, changed without a rebuild
Each agent runs on the model you pick for it. Switch it in one field, and its instructions, knowledge and tools stay exactly as they were.
Every major provider. OpenAI, Anthropic, AWS Bedrock and OpenRouter connect through one gateway, so Gemini, Mistral and Llama models are a pick away too.
An allowlist your admin owns. Only the models your admin allows appear in the picker. One place to rotate a key, one record of what was used.
Keys that never come back out. Provider keys are encrypted with AES-256-GCM and never returned, not by the UI, the API or an agent.
Agent Hub/Support Triage
Model
Allowed by your admin · 5 models
- openai/gpt-4ovia OpenAI
- anthropic/claude-sonnetvia Anthropic
- openrouter/google/gemini-provia OpenRouter
- openrouter/mistral/mistral-largevia OpenRouter
- bedrock/meta/llama-70bvia AWS Bedrock
Instructions, knowledge and tools unchanged
Tools/Gmail/Support inbox
Support inbox
Gmail · connected by Workspace admin
Actions this account exposes
- Search mail
- Read a thread
- Create a draft
- Send an email
- Delete an email
Whose account does the agent use?
Your tools, with only the actions you allow
Connect an app once and tick the actions it may use. An agent can read a thread without ever being able to send one.
Actions you choose. Only ticked actions can run. The list is frozen when the account is connected, so a new provider action never joins on its own.
Each person's own account. Sign in individually is the default: whoever runs the agent reaches only their own inbox, calendar or workspace.
Every call in the trace. Each tool call is recorded with its arguments, result and duration, and a switch to a shared account lands in the audit log.
- Gmail
- Slack
- Salesforce
- Notion
- Google Drive
- Google Docs
- Google Sheets
- Google Calendar
- SAP SuccessFactors
- Jira
- GitHub
- HubSpot
A manufacturer ran a 75-day proof of concept across 4 states, indexed 50,000+ hours of footage, and a litigation team is targeting a 40% cut in brief prep time.
Built for regulated teams
- Manufacturing50,000+hours of footage indexedSupply chain complianceAn early 75-day proof of concept across 4 states, with 750+ TB moved off on-site recorders.Read the case study
- Legal40%target cut in brief prep timeLitigation intelligence12 clauses surfaced from a 400+ page contract, every fact linked to its source.Read the case study
- Creator economy<60 minfrom idea to deployedCreator FlowA former TikTok product manager shipped a working product in a single sitting.Read the case study
Bring us one stuck workflow.
We take it to governed production with you, on your systems, in weeks, not quarters.
