Introduction

The structure that lets enterprise AI grow.

Trellaris is an enterprise AI agent platform built on one idea: employees build agents where they work, governance decides what climbs to the team and the company, and every run leaves a trace. The trellis is the frame; the agents are the vine.

Try the demo Read the concepts Deploy it yourself
3 ringsPersonal, team, organisation. Promotion between them is the only way up.
1 execution pathChat, automations, channels and agent-to-agent calls share one governed runtime.
13 policy kindsDLP, allow-lists, budgets, approvals, autonomy, egress, wake-ups, injection screen, conditional access, travel, data perimeter, breakers.
0 proprietary protocolsMCP for tools, A2A between agents, A2UI for forms in chat.
NewLabel the data, and the label decides how far an answer may travel Every collection, document, upload and chat attachment now carries one of four labels: Public, Internal, Confidential, Restricted. A run that reads Confidential material waits for a person before it searches the web, drives a browser or calls another agent; one that reads Restricted material is refused. Breakers pause an agent that keeps misbehaving before anyone is at a keyboard, and every trip opens an incident that records what was done. Nothing changes until you label something. How classification works →
NewDeep Research you approve first, and can check afterwards Ask a question on the new Research page and you see the plan — the sub-questions, the estimated cost and time — before anything is searched. Parallel researchers then record every finding with the exact passage it rests on; the report is written only from those notes, each sentence is checked against its passage, and each finding carries a confidence computed from its sources. How a research run works →
NewWrite a document or a deck with an agent, inside the workspace The Document Author researches the facts, then drafts beside you in a live preview — pages, or slides in your organisation's template — and revises as you ask, edit in place or type a quick edit. Save it into the workspace as Word, PowerPoint or Markdown, and reopen any file there to keep working on it. See the Document Author →
NewEvery organisation starts with a working set of agents A router that decides who answers, a general assistant, an IT desk and the hands to carry its requests out, a travel desk, a market watcher, a weather agent, a document author and four policy experts reading your own finance, HR, legal and procurement documents. Each is an ordinary versioned agent — read it, edit it, replace it with your own. Meet the built-in agents →
NewYour avatar now has a knowledge graph The people, projects, events and places in your world, extracted from your own mail, calendar and documents, each fact with where it came from and when it was true. Your avatar answers from it; colleagues see only what you shared; nothing they say changes it. Read how it works →
NewSecure code execution, one throwaway pod per run An agent can now run the script it wrote — a chart, a CSV, a PDF — in a sandbox that exists for that run alone: no network, no credentials, nothing kept, gone when it ends. In production every run is its own hardened Kubernetes pod, optionally its own lightweight VM, and the files it writes come back into the thread. How it is isolated →
NewAgents can act in the systems that have no API The browser tool lets an agent operate a web console the way a person does — open a page, read it, fill a form, submit it — under default-deny egress, an approval on every write, DLP on everything it reads, and a full recording of each step. The built-in IT Fulfilment agent shows it off: it carries out the requests the IT desk captures — licences, MFA, group membership, leavers — with a human approving each change. See the browser tool →

Why a trellis

Most enterprise AI programmes fail in one of two ways. Either IT builds a few sanctioned agents nobody asked for, or everyone builds their own and nobody can say what they do, what they cost, or what they touched. A trellis is the answer to both: it gives growth a structure without deciding in advance what will grow on it.

I · Personal ring

Anyone can plant

Every member gets a workspace with the full toolset: an agent designer, a playground, knowledge, memory, skills. No ticket, no waiting. Most good agents start as someone's Friday afternoon.

II · Promotion

Only the reviewed climbs

Scans, evaluation floors, red-team suites, policy floors and a human reviewer stand between a draft and the team or org ring. A promoted copy is pinned; the original keeps evolving.

III · Runtime

Everything leaves a trace

One runtime, one event stream, one usage ledger. Every model turn, tool call, approval and delegation is recorded, and the audit log exports to your SIEM.

What people do with it

Ask a policy question and get a cited answer

The built-in Finance, HR, Legal and Procurement experts answer from your own policy corpus and cite the chunk they read. They explain; they never act.

Raise an IT ticket from a sentence

The IT help desk decides the category, draws one intake form in chat (an A2UI surface) asking only what that category needs, and raises the ticket. The built-in ticket tool is simulated and says so; the ServiceNow connector is the real one, and files the ticket as the person asking.

Let an agent answer for you

Every person gets an avatar that answers questions about them and for them, from a profile, knowledge and memory they curated on purpose — and now from a personal knowledge graph built from their own mail and calendar, private until shared — reachable by name before any model is consulted.

Watch a market, draw the chart, never advise

The market watcher pulls prices, renders a full chart in the thread, and describes what it sees without ever telling anyone what to buy.

Research a question and trust the report

Approve the plan and its cost, watch the researchers work, and read a report where every sentence has been checked against the passage it cites — then export it into a workspace as Word or PowerPoint.

Turn a request into a finished deck

Ask the Document Author for a presentation; it gathers current figures, drafts the slides in your template, and keeps revising until you save it into the workspace.

See it

Twenty-five surfaces from the demo organisation, as they look today. Click any of them to enlarge it.

Build → Knowledge: collection cards labelled Restricted, Internal and Confidential, each with a classification picker, and a documents table with a Label column and a 'Label new uploads as' control.
Classification labels. New Four ordinal labels on every collection, document and upload. A member may raise one; only an admin may lower one. The label follows the content into every run that reads it.
Admin → Safety → Incidents: an open incident on the Market Watcher selected, with trigger chips for the signal, count, threshold and window, affected runs, an actions log and one button per containment action.
Incidents. New A breaker trip, a refused Restricted read or the emergency stop opens one; the admin contains it with the switches that already exist and closes it with a postmortem, all on the audit log.
Chat thread where the Market Watcher drew a candlestick chart of the BSE Sensex with a 20-day average, a volume pane and a zoom slider; the sidebar shows every product area.
Chat with a chart. Ask for a market and the agent draws the chart in the thread, with a hover readout and a click-a-point-to-ask affordance.
The My Avatar page: identity card with handle and version badges, a preview box that asks the avatar a question as a colleague, and the tabs Profile, Persona, Knowledge, Memory, Guardrails, Integration, Privacy, Activity, History.
My Avatar. An agent that answers about you and for you from what you curated; preview it as a colleague would hear it before you certify it.
My Avatar, Graph tab: a review card asking whether Q4 vendor consolidation is the same project as Vendor consolidation with Merge and Keep separate buttons, a browse list of node kinds with counts, and the Phase 25 launch project's facts, each with its source, the date it was seen, a validity window or a confidence, and a Forget button.
The avatar's knowledge graph. New People, projects, events and places from your mail, calendar and documents, every fact with where it came from and when it held; merges the extractor was not sure about wait for you first.
My Avatar, Knowledge tab: the Connected sources card with its Connect a source menu open, offering Gmail, Google Calendar, Microsoft 365 and Microsoft Teams.
Connected sources. New Gmail and Google Calendar in one consent round-trip, Microsoft 365 and Teams behind an administrator's switch; each source can be told whether it feeds the graph.
A Deep Research run on India's EV car market: the phase strip from Scope to Deliver, budget meters for cost, searches, tokens and time, the researchers with their searches, sources and notes, and one researcher opened to show its activity and its notes.
A research run. New The plan was approved before anything was searched; each researcher shows its searches, sources and notes, and every note carries the passage it rests on.
The workspace authoring view: a chat with the Document Author on the left and a live preview of a PowerPoint deck in the Trellaris template on the right, with Save and Edit text.
Authoring a deck. New The Document Author drafts on the right, in the chosen template, exactly as Save will build it; edit a slide in place or ask for a change on the left.
A chat thread where the Assistant answered a data question by running a script: an Activity row reads code_execution done, and the answer links customers.csv and customers.png with a two-sentence summary.
Code that runs in a sandbox. New The agent wrote and ran a script; the files it produced came back as artifacts. Each run is its own network-less, credential-less pod, deleted when it ends.
A team workspace's board with Backlog, In Progress, Awaiting Approval and Completed columns; a Deep Research task waits for approval while two completed tasks show their reports and cost.
A workspace board. Tasks here are worked by agents: anyone files one, a workspace admin approves it, and the result lands on the card with its cost.
The Automations page listing cron schedules and one-shot agent wake-ups with their agent, schedule, timezone and an on/off switch.
Automations. Cron schedules in the team's timezone, webhooks, watches and one-shot wake-ups an agent set for itself, each running through the same governed path as chat.
The agent designer canvas for the Deep Research agent: model and memory nodes above the agent card, autonomy set to trusted with a turn cap, tools fanned out below, and the surfaces that may invoke it on the left.
The agent designer. Wiring on a canvas: model tier, memory, autonomy and turn cap, tools and knowledge, and which surfaces may invoke the agent. The prompt itself stays in the YAML.
The Admin overview: runs today, spend over 30 days, active people, pending promotion reviews, agents by ring, automation volume, and the emergency stop.
Admin overview. What is waiting on you, what the organisation spent, agents by ring, and the one button that stops every agent, reversibly and audited.
The Playground's Evals tab for an avatar agent: success rate, average latency and cost per run above a table of eight graded cases, each with its assertion, and a historical performance chart by version.
Evals in the Playground. The cases the promotion gate will run, graded against the candidate version, with the trend by version beside them.
The Playground's Certify tab: a list of promotion gates for the Agent Architect with pass, pending and fail badges, and a note that they are the same gates the promotion queue applies.
Certify. The promotion gates, read rather than re-invented: definition, security scan, eval floors, eval suite, ring. A green result here is the answer the reviewer will get.
Analytics, Agents tab: one card per agent with activity, success rate, cost, latency percentiles, tokens in and out and the top failure, filtered to the last 14 days.
Analytics by agent. One card per agent across the organisation: activity, success, cost, latency percentiles, tokens and the top failure reason.
Analytics, Org dashboard: weekly active users, active agents by ring, automation volume, budget burn, adoption by team, spend by ring and a top-agents table with an Export CSV button.
The org dashboard. Adoption, agents by ring, automation volume, budget burn and showback by month, exportable as CSV.
Observe: a waterfall trace of one orchestrator run delegating to the Market Watcher, with model turns and tool calls nested under each other, durations on every row, and the selected step's input and output on the right.
A run trace in Observe. Every model turn, tool call and delegation on one timeline, nested under the turn that asked for it, with the step's input and output beside it.
Settings, Your connections: a catalogue of IT service management connectors such as BMC Helix, Cherwell, Freshservice, Ivanti, Jira and ManageEngine, each listing its read and write operations and a Connect button.
Your connections. Connectors are personal: an agent acts as you and sees only what you can see. Each card lists its read and write operations, and writes ask for approval.
Admin, Safety, Kill switches: an org-wide emergency stop with a Stop everything button, and a target card for the Agent Architect showing in-flight runs, parked approvals and active automations, with Kill agent and Pause instead actions.
Kill switches. Pause or kill one agent, suspend a person, or stop the whole organisation. Every action is audited and takes effect on the next turn of every running run.
Admin, Safety, Risk register: an agent picker with a Compute risk button, and the Agent Architect's entry rated LIMITED with EU AI Act and NIST AI RMF labels and the inputs that produced the score.
The risk register. Risk is computed from write scope, data sensitivity, autonomy and ring, then mapped to EU AI Act and NIST AI RMF tiers. High tiers need a dual-authorised attestation.
Admin, Safety, Privacy and retention: three privacy tiers as radio cards, Tier 1 maximum privacy selected as the default, with an impact notice and a review-and-save panel beside them.
Privacy and retention. The tier that decides what an administrator may read, with Tier 1 as the default: metadata only, never conversation content. Retention windows per class of data sit below.
Admin, Compliance, Audit log: a filterable table of governance events with UTC timestamps, actor, action chip, target and scope, plus Legal holds and SIEM export buttons.
The audit log. An append-only record of governance events, metadata only by construction, filterable by actor, action, entity and time, and exportable to your SIEM.
Admin, Governance, Policies: the browser egress policy editor with scope chips from organisation down to agent, reachable and blocked host lists, and a guardrail floor checkbox.
A policy editor. Every policy kind takes a scope from organisation down to a single agent, resolves deny-wins and most-specific-wins, and can be declared a floor a narrower scope may only tighten.
The Voice page: organisation switches for voice input and read-aloud with a disclosure that dictation uses the browser's own speech engine, and personal preferences for auto-read, voice, speed and dictation language.
Voice. Dictation and read-aloud use the browser's own engines and say so; an administrator can switch either off for the organisation, and each person keeps their own preferences.
Catalog, Skills: cards for the built-in skills basic-chart-builder, csv-cleaner, data-profiler, ics-scheduler, pdf-report and web-summarize, each in the org ring, with ring filters and semantic search.
Skills. Reusable bundles an agent loads on demand: instructions, scripts and reference files. Thirteen ship with the platform, scan-passed, and yours sit beside them.
Tools and Gateways: the Built-in tab listing web_search, web_fetch, browser_use and code_execution with what each does and how to declare it, beside tabs for MCP servers, gateways and virtual REST-to-MCP servers.
Tools and gateways. First-party tools, registered MCP servers, and governed gateways that publish a chosen tool set as one MCP endpoint for agents and external clients alike.

What the platform enforces

Every item below is a control that exists in the product today, not a roadmap line.

Trellaris platform documentation Introduction · Concepts · Building · Governance · Platform · Samples