Not another chatbot. An AI Operating System.
Supervised missions you can actually govern
FleetRun gives agents a role, a budget, and a limit on what they may do without asking. The invite-only pilot focuses on bounded missions, approval gates, cost traces, and the read-only integrations marked available below.
Org charts with people in them
An agent reports to another agent or to a named person, and people report to people. The reporting line is enforced in the database — a manager must be in the same fleet, and a cycle is rejected outright.
- Agents and humans in one reporting tree
- Cycle and depth checks at the database level
- Delegation recorded on the mission itself
Approval gates before it matters
An agent that reaches something consequential — sending, spending, deleting, exporting — stops mid-run and asks. The mission is blocked, not silently completed. Approve and it resumes with the decision fed back in; reject and it cancels and unspent funds are released.
- Autonomy levels: propose, act on low risk, act
- Escalation walks the chart and always ends at a human
- Business owners and admins decide; Family owners, admins, and Adults decide; every decision is stamped
Missions traced step by step
A mission keeps an append-only event log plus a per-step record of which provider and model ran, what came back, and what that step cost. A failed run is readable rather than mysterious.
- Per-step provider, model, usage, and cost in cents
- Append-only event log per mission
- Heartbeat tracking so a stalled run is not read as finished
Budget reserved before a run starts
The Fleet Wallet holds a prepaid balance. Before a mission runs, its worst-case cost is reserved against that balance, and the run refuses to start if the reservation cannot be covered. Reservations settle to actual cost afterward and the remainder is released.
- Pre-flight reservation, not after-the-fact reconciliation
- Per-call ceiling checked before the model is invoked
- Never charged more than was reserved — that ceiling is the promise
- Full ledger: reservation, debit, release, refund
A provider-neutral model gateway
Agents ask for a capability tier, never a vendor. FleetRun picks the model, falls back when one fails, and records which one actually answered.
Routing and fallback
Models are grouped into cheap, balanced, and premium tiers. A rate limit or provider outage moves the call to the next model in the tier instead of failing the mission.
Cost estimated before the call
Each candidate model's worst-case cost is computed before the request is sent, and a model that would breach the mission's ceiling is skipped rather than tried.
Charged on reported usage
Estimates reserve funds; the amount recorded against the wallet comes from the usage the provider actually reports. An estimate is never what gets charged.
Integrations
Google Workspace, Slack, and Notion are available today. Planned providers stay labelled as planned until their connection and agent capabilities pass end-to-end verification.
Where this stands today: Google Workspace supports bounded Gmail, Calendar, Drive, and Contacts tools. Slack supports public-channel discovery and history. Notion supports title-based page and data-source search. Consequential writes remain separately scoped and approval-gated.
Google Workspace
Gmail, Calendar, Drive, and Contacts. Read-only to start — agents draft, you approve.
- Search mail and threads
- Read calendar availability
- Search Drive files
- Read a Drive document
- Look up contacts
- Draft an email for approval
- Propose a calendar event
Slack
Public-channel discovery and history, so agents can prepare a handoff with the relevant context.
- List public channels
- Read public-channel history
Notion
Pages explicitly shared with FleetRun — found by title, then read in full for grounded research and drafting.
- Search pages
- Read a page
Stripe
Customers, invoices, and payouts for finance workflows. Read-only, always.
- Read customers
- Read invoices and payouts
Handling credentials and data
Connecting a mailbox to an agent is a serious act of trust. These are the controls that are implemented today.
Connector credentials encrypted at rest
OAuth tokens are encrypted before they reach the database using AES-256-GCM under an application key held in the server environment. Every write gets a fresh IV and authentication tag, so stored ciphertext is authenticated and tampering fails decryption.
Fleet-scoped access control
Row level security is enabled on every workspace table, so a query can only return rows for fleets the signed-in account belongs to.
Least-privilege OAuth scopes
Google Workspace connects with read-only scopes. Creating a draft reply needs a separate consent, and even then the draft is written for you to send — FleetRun never sends on your behalf. Disconnecting revokes the grant at Google before the record is deleted, and the scopes actually granted are recorded rather than the ones requested.
On compliance claims: FleetRun does not hold SOC 2, ISO 27001, HIPAA, or any other certification, and does not claim to. Independent penetration testing and a formal compliance programme are planned but not complete. We will say so plainly here when that changes.
Put your first agent to work
Start from one of three templates with a written role and an autonomy level chosen for the blast radius of the work, place it in your org chart, and fund a wallet it cannot overspend.
Your subscription pays for the platform. Model usage is billed from your Fleet Wallet.