PANTHEON
PANTHEON
Not an assistant that only answers — one you could hand real money, other people's data, and its own initiative, because a safety layer sits underneath and stops it when it shouldn't. The assistant below is running on that layer right now. Built solo · live in production. What is this? →
Try to break the assistant ↓↑ Bespoke generative art, rendered by PANTHEON's own generator — as are the favicon, social card and avatar. The page is built by the thing it describes.
Letting an AI take a payment, message a customer unprompted, or change your live website — without it leaking one customer's data to another, spending money it shouldn't, doing something big without a human's OK, or being sweet-talked off the rails.
PANTHEON is the safety layer that makes handing over those keys safe. Every customer's data is walled off from every other's. Anything consequential waits for a person to approve it. Spending is capped. There's a kill switch. And the assistant just below runs on exactly that layer — so don't take my word for it. Ask it.
It's a governed tenant on a live multi-tenant substrate — every message clears an auth gate, an RLS scope boundary, a credit meter and a guardrail before it answers. The panel shows those four checks firing for your turn. Try to break it.
A guarded chatbot that refuses bad things is table stakes. The harder claim is a system that does consequential things — spends, sends, changes live state, on its own initiative — and stays inside the same guarantees. Three places PANTHEON already does exactly that:
Stay Steward drafts and sends a message no one asked for — a check-in before a guest arrives, a thank-you after they leave — on its own schedule. Every send clears the same rails as a chat turn (crisis · kill-switch · rubric · PII-redaction); the owner approves its first messages and it only graduates to autonomy once trusted; it can never message a guest twice; and a guest can opt out any time (STOP / one-click).
One business exposes its agent as a priced tool; another business's agent can pay to call it. The substrate meters, isolates, and governs every cross-tenant call: the caller consents to a price and is charged, the provider earns their share, the transfer is atomic and overdraft-proof, and crisis + per-caller spend caps clear before a single credit moves.
A non-technical owner describes their business and gets a themed website with a governed assistant — bookings, channels, a real deposit checkout — then edits the whole thing by chatting to it. It's making changes to production systems that take real customer money, inside the same isolation and approval guarantees.
Not "trust me, it's secure." A live product, and a security discipline that keeps re-attacking it — the latest a 50-agent audit whose fixes shipped, then a 14-lens adversarial re-audit, every finding refuted by a separate agent before it counted.
Three concrete attacks on the live system, and exactly what it does. Each is a button on the prove-it page, wired to the real database, the real approval queue, and the real kill switch.
A shared tool, called by tenant B, asked explicitly for tenant A's rows → Postgres returns zero rows. The tool runs under B's scope on a NOBYPASSRLS role, so a bug in app code physically can't cross the boundary.
Prompt-injection aimed at the assistant → the injected order doesn't take. Untrusted tool text is stripped of bidi / zero-width / tool-call markup before it's ever read, and the governance eval scores the resist pass/fail, live.
A high-stakes action doesn't just run → it's classified, checked against the kill switch, and parked for a human. Flip the kill switch and tier-3 refuses before it can even queue.
A multi-tenant substrate owns the reasoning loop, the tool registry, governance, metering and isolation. Residents (governed agents) and bundles (vertical products) compose those primitives without ever touching the core — a purity boundary the CI enforces on every commit.
If governed, multi-tenant agent infrastructure is the problem you're solving — the substrate, the residents, the Studio, and the audit discipline behind them are all one person's work. Let's talk.