CAPABILITY
TEAMS
ASSIST
ENTERPRISE
MEMORY & CAPTURE
Enterprise BootstrapOne set of instructions for every agent, layered org to user
●
●
●
Conversation captureClaude Code, Codex, Cursor, Windsurf, Cline and Gemini CLI, plus any MCP client. 1.86 s p95
●
●
●
Bi-temporal memory recordsValid + recorded time; as-of queries, diff, restore
●
●
●
Review queues & governanceApproval inbox, decay policies, pin/archive, sensitivity flags
●
●
●
Hybrid retrievalBM25 + vector + graph, RRF/MMR rerank — 0.98 recall@8
●
●
●
Counterfactual replayRe-run with memory withheld; signed influence record
—
●
●
Provable deletionCryptographic erasure with per-unit key destruction
—
●
●
CONTEXT & OPTIMIZATION
Context snapshot builderDrag-drop composer, token budgets, Bootstrap Core compiler
●
●
●
7-step optimization pipelineChunking, embedding, knowledge graph, ranking, compression, assembly, expansion
●
●
●
Dynamic token budgetsFeedback-loop prediction and adaptive compression
●
●
●
Six-state disclosure controlPossessed → transmitted, governed per model destination
—
●
●
Compiled blocks with provenanceSHA-256 identity + Ed25519 receipt per assembly
—
●
●
Iceberg analytical lakehouseTime-travel as-of reads over the full record
○
●
●
GOVERNED EXECUTION
Two-phase authorization gateBlocking, fail-closed, on chat, socket, MCP, and REST
—
●
●
Maker–checker approvalScope-bound, single-use tokens from a distinct checker
—
●
●
Post-state verificationServer re-derives authoritative state; mismatches recorded
—
●
●
Signed execution receiptsEd25519 + HMAC-SHA256, hash-chained, offline-verifiable
—
●
●
Agent fleet operationsRegistry, lifecycle, heartbeats, kill switches, skills marketplace
—
●
●
Token budgets & spend controlsHourly/daily/monthly limits by agent, project, or org
—
●
●
COMPLIANCE & EVIDENCE
Signed evidence bundlesHash-chained, insert-only, offline verifier: VALID / TAMPERED / INVALID
—
○
●
Enforcement-derived controls15-control registry mapped to SOC 2 CC1–CC9
—
○
●
Framework crosswalksHIPAA, GDPR, DORA, EU AI Act on one canonical model
—
○
●
Audit access surfacesAccess-event trails, receipt export, verification keys
—
○
●
SECURITY & DEPLOYMENT
RBAC + JWT authenticationRole tiers, refresh rotation, service accounts, RLS isolation
●
●
●
Native secret managementEnvironment separation, versioning, fail-closed references
●
●
●
Native PKI / KMS / SSH / PAMKeys and privileged access under the governed record
—
●
●
BYOK / HSM custodyCustomer-held keys, managed receipt-key rotation
—
—
●
Self-hosted deploymentRuns as native services under PM2, or from the signed offline installer
—
—
●
SLA & dedicated supportEnterprise support with uptime commitments
—
—
●
OPERATIONS, IDENTITY & PROGRAMS
SQL RoomsGoverned DuckDB SQL workspaces; optional on Teams
○
●
●
Approvals in Slack & TeamsWith Jira and ServiceNow tickets, per project
—
●
●
Identity directoryPeople, agents, service accounts and credentials in one directory
●
●
●
Secret sync & rotationSeven destinations, certificate sync, credential rotation
—
—
●
Offline installerSigned media, SBOM, checkpoint rollback (release candidate)
—
—
●
SOC 2 & ISO 27001 programsWith the Compliance Evidence add-on
○
○
○