The governed passage for agent work
One MCP URL per organization. Permissions per call. Credentials in custody. A verifiable record.
Call mcp__docs__read agent:analyst
Illustrative example with synthetic data. Product names and logos belong to their owners. Examples only; no endorsement implied.
Every crossing passes the same five gates. The record below is the same one section 3 starts from.
The passage knows who calls: a person, an automation, or an agent with a key.
agent:analyst authenticated
The policy answers one question: may this caller touch this tool, this way?
read allowed · write denied
The credential never reaches the agent. The passage holds it and uses it on the caller's behalf.
credential in custody, never exposed
The call crosses to the tool. A denied call never leaves the border.
mcp__docs__read executed
Arguments stay out of the record. The hash-chained receipt stays in.
receipt sealed · #a3f9…c21d
Pick a scenario. Both leave a record; only one reaches a tool.
Illustrative example with synthetic data
Want this boundary around your agents? Join the waitlist
Scheduled work and private interfaces cross the same channel, under the same policy.
Three steps, one graph: gather two sources, merge, notify. Each step crosses as its own call, with its own receipt.
Each step of the graph returns to the channel.
An automation is a graph of steps. A step never borrows the next step's permission: each one authenticates, each one is judged by policy, each one leaves a receipt.
A private interface inside the dashboard with one action: approve the weekly report. The action crosses the channel like any call.
Weekly report · private App
Waiting for approval
A private App is an interface with a narrow permission. Pressing the button issues one call through the passage — identity, policy, credential, record — exactly like an agent's call.
Illustrative example with synthetic data
Six parts, no magic. What the passage does not do is written down next to what it does.
Agent, automation, or App.
One MCP URL per organization.
Who calls, and with which key.
What this caller may touch.
Credentials in custody, calls placed.
The tool or API behind the border.
On the way back: redaction, then the sealed record.
Daphnis is a governed MCP endpoint for an organization: each agent call is checked for identity and policy, placed with a credential the agent never sees, and written to a hash-chained record.
Agents that speak MCP, such as Claude, connect to one URL per organization, each under its own identity. The logos on this page are illustrative examples, not partnerships.
It stops at the border. The tool is never reached, and the denial is still written to the record with the reason.
The launch is a waitlist for access. Deployment options will be announced to the list before general availability.
Each caller — person, automation, or agent with a key — authenticates at the edge. Every decision downstream names that identity.
No. Credentials stay in the broker's custody. The agent asks; the passage presents the credential upstream on its behalf.
Structure, not content: who called, which tool, the decision, and a hash-chained receipt. Arguments and prompts never cross into the UI or the record.
Interfaces inside the dashboard with narrow permissions. Each action they take crosses the same passage as an agent's call.
News about Daphnis availability. One email, nothing else required — no name, no phone, no company size.
Still interested? Join the waitlist
