Build agents. Keep control.
Chat, agent role definitions, and governed worker execution are implemented in the repository. Availability depends on configured providers, models, tools, and workers.
Built · development scope Ghalta Studio, reviewed 19 October 2026. Code implementation does not establish production availability.
Example · illustrative data
Studio task: summarise the March refund queue
- customers.read
- One customer record — decision recorded before execution.
- Allowed
- refunds.post
- Fourteen refunds — waits for a person.
- Approval
- mail.send
- Matched sensitive fields masked.
- Redacted
Illustrative worker path; requires configured tools and policy.
Chat with configured model providers
Studio implements conversations, message streaming, attachments, and model selection. Provider adapters cover OpenAI-compatible APIs, Anthropic, Google, and Amazon Bedrock. Tenant configuration and model capabilities determine which features are usable.
The direct chat route can request delegation to an agent role. It rejects other tool names: chat itself is not a general tool executor. Delegated work runs through the separate Studio worker.
Blocked providers are refused. A configured adapter is not evidence that every vendor or model has been tested in a live deployment.
Define roles and govern worker actions
Agent definitions specify roles, allowed models and tools, delegation targets, and limits. The worker evaluates model and tool calls with the shared deterministic policy engine, applies session constraints, and records decisions.
Approved, configured MCP and sandbox tool paths can execute in the worker. Delegation creates child sessions with bounded contracts and minimal handoff context. Holds and escalation use the approval path.
Current execution is bounded to a single model turn per worker step. Tool results are recorded, not fed into an automatic next-turn loop. Chat handles the first requested tool call in a turn; it does not promise parallel tool execution.
An implemented text privacy boundary
Outbound chat text is tokenized before provider use. Detection combines regex patterns, Presidio entity recognition, and structured field classification. Recognized values become placeholders backed by an encrypted vault.
Stream handling restores authorized placeholders for the human reader. Worker tool results are tokenized before entering agent context; real tool arguments are restored at the execution boundary under the vault's authorization checks.
Illustrative data
One sentence, before and after
- Typed in Studio
- Refund the March order for Maria Rossi, maria@example.com.
- Sent to the provider
- Refund the March order for [PERSON_1], [EMAIL_1].
Detection is not a promise that all sensitive content is found. Unsupported language or analyzer failures block the text path. Image attachments are not scanned by this tokenizer; supported image input can reach a vision provider. Review the attachment and model configuration before sending images.
Review the boundaries before an evaluation
See policy behavior, delegation limits, and repository status. To discuss a configured evaluation, get in touch.