Let AI agents act inside your organization, without giving them the keys.
Each AI agent gets its own identity and only the capabilities it was granted.
Short answerTunnel t0 (Zero-Trust) is infrastructure for AI agents that work with an organization’s own systems. Each agent gets its own identity and a set of explicit capabilities. Its requests go through a Tunnel connector, which refuses anything not granted, sends consequential actions to a named person through Flamecloak, and records every call. The agent never holds your credentials. It is in development and not available yet.
In development. There is no date we could honestly give you, so there is none: leave your address and we will write when there is something real to try.
The agent does not own access. Tunnel grants capabilities.
An agent can have legitimate credentials and still make an illegitimate decision: a prompt injection, a misread instruction or a plain reasoning error turns authorized access into an outcome nobody authorized. So the agent is given no standing access at all.
Its own identity
Every agent is registered on its own, with its own key and the person or team it acts for. A key can be revoked at any moment, and the record always says which agent acted.
Explicit capabilities
Each thing an agent may do is granted on its own, and it is allowed, sent to a person, or refused, under conditions you write, such as refunds below a set amount. Anything not granted is refused: the default is no.
The credentials stay with Tunnel
Your API keys and tokens stay with Tunnel. The agent never holds them, so it cannot leak them, reuse them, or use them to go around the rules.
A person for the consequential ones
Some actions must not happen until someone says yes. Flamecloak’s approvals are part of the product: the call waits, a named person decides, and only then is it made, once.
Only the data the task needs
A capability can pass on only some fields of a response, such as a customer’s status and order history without their payment details, and when that cannot be guaranteed, nothing is passed on.
Limits over many calls
A rule for one call can be split into many small ones, so limits also hold across many calls, and what goes over them is refused or sent to a person.
A record of every call
Allowed, refused or decided by a person, every call is recorded with the agent, what it asked for and the outcome, in a tamper-evident record you can check. Request bodies and credentials are never in it.
What every request is held to
Every time, for every agent.
Unknown agents get nothing
An agent Tunnel does not know, or one whose access was revoked, is turned away before anything else happens.
Its own secrets go nowhere
Whatever the agent sends, the only credentials that ever reach your systems are the ones you gave Tunnel.
Only what was granted
Anything this agent was not granted is refused, and the reason is recorded.
Limits it cannot talk its way past
A limit is checked against what would actually happen, never against what the agent says it will do.
A person, when it matters
A named person approves or refuses, and what they approve is exactly what happens.
Once, never twice
An approved action happens exactly once.
Only what the task needs, on the record
What the task does not need is withheld, and every call goes into the record.
Where it runs
The part that holds your credentials runs in your network, or, for public APIs, on our side. Everything a person does is in your Tunnel dashboard.
In your network
The connector runs inside your network, next to the systems it protects, as a container or a service. It only connects outwards, so it needs no inbound port.
Or on Tunnel’s side, for public services
For public APIs such as a payment provider, we can run the connector for you instead. It reaches only the services you named, and the credentials you give it are encrypted in your browser and opened only inside it.
Everything a person does, in the dashboard
Registering agents, granting capabilities, approving actions and reading the record all happen in your Tunnel account.
What Tunnel t0 (Zero-Trust) does not claim
The boundary holds only if the agent cannot go around it. The machine the agent runs on must hold no credentials and reach nothing but the connector, which is a network rule on your side. We will ship reference configurations and a check that proves it from the agent’s side; until that rule is in place, not every interaction crosses the boundary.
The connector sees every request and response that passes through it. In your network it runs on your hardware, under your control; when we run it for you, it runs on ours. Its record never holds bodies.
A capability with no response rule passes on the whole response. Trimming is chosen capability by capability, and the dashboard shows which have none.
It does not filter records by subject, such as leaving unrelated customers out of one response. That is separate work, built when somebody asks for it.
It does not judge whether an agent is right. It decides what the agent may reach by rules you write; no model and no score takes part in that decision.
There is nothing to buy or try yet, and no date.
Questions people ask about this
Do our agents have to be rewritten?
No. An agent sends its HTTP requests and MCP tool calls to the connector instead of straight to the service, with its own Tunnel key. Nothing else in it changes, and it does not need to know Tunnel exists.
How does it relate to Flamecloak?
Flamecloak is Tunnel’s action-authorization layer, and its approvals are included: a capability that needs a person uses the same approvers, the same approvals on a phone and the same record. You do not need a second product.
Where do the credentials live?
With the connector, and nowhere else. They are never shown to the agent, never written to a log, and never shown again once entered. If the connector runs in your network, they never leave it. If we run it for you, they are encrypted in your browser and opened only inside that connector when a call needs them. Run it yourself if no one at Tunnel should ever be able to reach them.
What happens when an approval takes a while?
A quick approval answers the same request. A slower one never opens a second decision or causes a second action: once approved, it runs once.
Is the decision a risk score?
No. Whether a call is allowed, refused or sent to a person comes from conditions you write over the request itself: an amount, an account, a field. No model scores it, and the record says which rule decided.
When can I use Tunnel t0 (Zero-Trust)?
There is no date, and an invented one would be worth nothing to you. It is in development, has no price and nothing to sign up for. Leave your address on this page and we will write when there is something real to try.