Identity and tenant isolation
The hosted control plane accepts Sites identity only when the trusted boundary is explicitly enabled. Every organization-owned query carries the organization identifier and verifies current membership and role on the server.
- No client-selected authority
- Organization-scoped API keys
- Final owner cannot be removed
- Seat and active-run limits rechecked transactionally
Durable control, isolated execution
D1 stores identities, organizations, projects, investigations, approvals, leases, usage, and audit history. R2 stores phase results, checkpoints, and artifact bytes under organization- and investigation-specific keys. The durable workflow uses a short-lived credential scoped to one organization, investigation, attempt, and lease owner.
Only credential hashes are stored. The OpenAI key remains a managed runtime secret and never enters workflow payloads, outbox records, checkpoints, artifacts, progress events, or audit history.
Append-only accountability
High-impact mutations append to a per-organization SHA-256 audit chain in the same transaction as the state change. Sequence guards prevent concurrent forks, and database triggers prevent audit rows from being updated or deleted.
- Membership and role changes
- Approvals and lifecycle transitions
- Budget, usage, and artifact events
- Compute and provider dispatch
- Billing entitlement changes
Bounded dedicated compute
Team and Program include one concurrent private VM shape for an approved investigation. The compute control plane never accepts an arbitrary project, instance path, region, or machine size: it selects only the plan allowlist and records every lifecycle intent before contacting Google Cloud.
- One active dedicated VM per organization
- Spot capacity with automatic deletion after at most four hours
- No public IP address or internet NAT
- No VM service account or Google API scopes
- Stop and delete operations restricted to the exact tenant-bound instance
A dedicated VM is an approved, bounded research session rather than persistent hosting. Work that must survive interruption belongs in a verified ApolloBot checkpoint or artifact.
Deployment modes
Core runs in infrastructure you operate. Cloud adds the managed control plane and dedicated research environment. Enterprise supports a dedicated or customer-controlled deployment with separately agreed residency, identity, and network policy.
- 01Validate the release privately
- 02Configure provider bindings and secrets
- 03Exercise failure and replay paths
- 04Enable external actions with exact caps
- 05Open access or DNS only after a separate launch review
See the lifecycle in motion.
Pose a question and watch the governed investigation demo advance stage by stage.