Let AI, apps and people use your private systems. Never your network.

Give each AI agent, app or person a grant for exactly what it needs: read a folder, call an internal service, or restart a deploy once a second person says yes. Every grant ends on its own and is on the record. No VPN, no open port, no shared password.

Get in touch See the product

AccessAcme

Illustration of the console, being built. Example data.

On-call agentfor Alice

Live

Can: Read and list files
Scope: /var/log/checkout
On: checkout-01, Linux
Granted by: Policy: on-call reads checkout logs
Path: Direct

On the record

09:41:02read error.logallowed
09:41:05list the folderallowed
09:41:09write error.logrefused

Ends in

Today, access means the whole network.

A network
To let an agent or a contractor fix one thing, teams add it to a VPN or a mesh like Tailscale, then write rules to fence it back in.
A key that lasts
A password or an API key works for whoever holds it, from wherever it was copied, until someone changes it.
AI makes it risky
Agents act on their own and follow instructions they read along the way. Whatever they can reach, one mistake can reach too.

Connect to the capability, not the network.

A small Node sits beside your systems and only dials out. Each caller reaches exactly the capability its grant names. Nothing else is connected.

One platform for everything private.

Many callers and many capabilities, with one place to decide, watch and stop. It reads left to right.

Who connects

AI agentsToday (tests)
Sub-agents, handed lessToday (tests)
Apps and servicesToday (tests)
CI jobs, with no stored secretToday (tests)
People, in a browserBuilding

What you control

Policy: who may ask for whatToday (tests)
Scopes: which folder, service or actionToday (tests)
Approvals by a second personToday (tests)
Time limits: minutes, not monthsToday (tests)
Narrowing that never widensToday (tests)
Stop a grant, a policy or everythingToday (tests)
The record of every callToday (tests)
Sign-in with your identity providerToday (tests)

What you can connect

Your own services, through the SDKsToday (tests)
Files and foldersBuilding
Approved commandsPlanned
HTTP APIs, through an allowlistPlanned

Today (tests)BuildingPlannedWhat each status means

Every grant is exactly what it needs. That is what makes it safe to say yes.

Only what you name.

You name the capability and its scope, such as reading one folder. It gets no network access, no login and no key that lasts. Anything else is refused, and the refusal is on the record.

On-call agentfor AliceRead files in /var/log/checkout

read /var/log/checkout/error.logAllowed
write /var/log/checkout/error.logRefused: it may only read
read /home/alice/notes.txtRefused: outside its folder
open a shell on checkout-01Refused: there is no shell to open
connect to 10.0.4.12:5432Refused: an address is not a capability

Every refusal is recorded too.

It ends on its own, and only ever narrows.

A grant lasts fifteen minutes by default and an hour at most. It can be made shorter or smaller, or handed to a sub-agent with less, never more. Needing more means asking again.

On-call agentfor AliceRead and list /var/log/checkout

Ends in

Shorter or smaller is allowed. Longer or wider is refused.

Every call is on the record. Stop it at any moment.

Each call is written down: who made it, on whose behalf, what was asked for and the result. What was asked for, never what came back. Stop the grant and the next call is refused.

09:41:02On-call agentAliceread error.logallowed
09:41:05On-call agentAlicelist the folderallowed
09:41:09On-call agentAlicewrite error.logrefused
09:41:13Triage sub-agentAlice, via the agentread error.logallowed

In end-to-end tests the next call is refused within five seconds of stopping.

It runs beside your systems, and only dials out.

The Cloud decides who may ask for what. The Node checks every call itself, and keeps honouring grants until they end even if the Cloud is out of reach.

The Node

Runs beside a private system. Opens no inbound port, keeps its data encrypted, runs each capability as its own user.

Today (tests)Linux BuildingmacOS, Windows

The Cloud and console

Sign-in, policy, approvals, the record, and a view of what each agent can do, for every organisation separately.

Today (tests)on one machine Buildingthe hosted service

The SDKs and client

Python and TypeScript for your own capabilities. A native client for agents, services and CI jobs.

Today (tests) Buildinga browser client

The path

Direct when the two ends can reach each other; through an end-to-end encrypted relay when they cannot and policy allows it. The path never decides what is allowed.

Today (tests) Buildingmanaged relays

Self-hosting

Your own authority, issuing the same grants the Node already checks.

Planned

Built for jobs like these.

An AI product inside a customer's systems
The customer runs a Node and exposes one capability, such as looking up an order's status. No VPN, no inbound port, no shared key. They see every call and can stop it.
Today (tests)the mechanism Buildingthe hosted Cloud
An on-call agent during an outage
It reads one service's logs for fifteen minutes. Stop it and the next read is refused.
Today (tests)the mechanism Buildingfiles
A button that needs a second person
Inspecting a deploy is free. Restarting production waits for someone else's yes, and that grant lasts five minutes at most.
Today (tests)
A CI job with no stored secret
Its own identity token becomes a short grant to fetch a nightly report from a machine that accepts no incoming connections.
Today (tests)the exchange Buildingfiles
An agent that hands a sub-agent less
Read only, one folder, five minutes. The record reads Alice, then the agent, then the task.
Today (tests)
“What can this agent do?”
A security lead sees every grant an agent could get and who can restart production, then stops a whole policy at once.
Today (tests), not hosted
A contractor for an afternoon
One folder, read only, until the job is done. Nobody has to remember to remove it.
Buildingfiles

Network access hands over a network. Capability access hands over one capability.

Keep your mesh for your team's devices. Use ByteTraverse for what agents, apps and outsiders may touch.

VPN or mesh for example Tailscale

Reaches
Hosts and ports on the network, narrowed by access rules
Who, on whose behalf
A device or a user; not whom an agent acts for
Lasts
Until the device key expires or is removed, often months
Taking it back
Remove the device or change the rules
SSH key or API key

Reaches
A whole machine or account, from anywhere the key is copied
Who, on whose behalf
Whoever holds the key
Lasts
Until it is rotated; certificates can be short
Taking it back
Replace it everywhere it is used
Access gateway or bastion

Reaches
An app or a host session, through a central gateway
Who, on whose behalf
A signed-in user or a service account
Lasts
A session, as long as the gateway allows
Taking it back
End the session or remove the user
ByteTraverse

Reaches
One capability on one system, within a set scope
Who, on whose behalf
The caller and whom it acts for, on every call
Lasts
Fifteen minutes by default, an hour at most
Taking it back
Stop it; the next call is refused

Kinds of tools, not products; each can be set up more tightly than its default. ByteTraverse works beside them. It is not a VPN, a reverse proxy or an identity provider.

Where it stands.

In development. “Today (tests)” means shown end to end on one machine, on Linux, against the Cloud's own code. Nothing is deployed yet, and there is no sign-up.

Who connects

AI agents and services, through the native clientToday (tests)
CI jobs and workloads, with no stored secretToday (tests)
Sub-agents, handed a narrower grantToday (tests)
Apps and people in a browserBuilding

What you control

Policy, scopes and time limits: 15 minutes by default, an hour at mostToday (tests)
Approval by a second person for risky operationsToday (tests)
Approvers in Slack or through a webhookPlanned
Narrowing that can never widen, property-testedToday (tests)
Stopping a grant, a policy, a principal or everythingToday (tests)
The record of every call, refusals includedToday (tests)
Separate organisations; sign-in with Google, GitHub or any OIDC issuerToday (tests)
The admin console, including “what can this agent do?”Today (tests), not hosted

What you can connect

Your own services, through the Python or TypeScript SDKToday (tests)
Files and foldersBuilding
Approved commands, never a shellPlanned
HTTP APIs, through a method and path allowlistPlanned

Where it runs and how it reaches

The Node on LinuxToday (tests)
The Node on macOS and WindowsBuilding
The hosted CloudBuilding
Direct first; an end-to-end encrypted relay only where policy allowsToday (tests)
Managed relays in Sydney, US East and EuropeBuilding
Your own authority, issuing the same grantsPlanned

Not claimed

An outside security test. One is planned before the first customer.
An independent review of the cryptography.
A direct path on every network. Some mobile networks prevent it.
Customers, certifications such as SOC 2, or uptime figures.

For engineers.

The real commands, output and record, from the repository. Everything above rests on these. Ids are examples.

01Run a Node beside the systemToday (tests), Linux

It keeps its state in one encrypted database and dials out to the Cloud over TLS. No inbound port, no public address.

On the server, example output

# btv-node init --config /etc/btv-node/btv-node.json
endpoint_id=nd-wnzh7ba3udyhsp7vfhmadtx6pm
key_posture=key-file
# systemctl enable --now btv-node

02Install a capabilityToday (tests); the files provider is Building

The Node records the provider's definition and its user, and hands the provider a token only that user can read.

On the server, example output

# btv-provider-files define > files.json
# btv-node capability install --config /etc/btv-node/btv-node.json \
    --definition files.json --provider-user 996 --provider-dir /var/lib/btv-files
installed=bytetraverse.com/files@1
definition_digest=7d0c…e41a
token_file=/var/lib/btv-files/token
provider_config=/var/lib/btv-files/provider.json

03Write the policyToday (tests) in the Cloud's code; hosted Cloud Building

Who may ask, for which capability, on which Nodes, within what scope, for how long. Operations marked high-risk also need a second person's approval.

POST /v1/orgs/{org_id}/policies

{
  "name": "on-call reads checkout logs",
  "principals": { "kinds": ["agent"] },
  "capability_id": "bytetraverse.com/files", "version": 1,
  "nodes": { "labels": { "service": "checkout" } },
  "scope_ceiling": { "root": "/var/log/checkout" },
  "operations": ["read", "list", "stat"],
  "max_ttl_seconds": 900
}

04The agent calls itToday (tests) with the built-in capability; files shown

It trades its identity token for a lease bound to its own key, narrows it for the task, and reaches the Node through a sealed rendezvous: directly, or through an end-to-end encrypted relay where policy allows. Here the lease is revoked before the third call. The files capability is shown for readability; the end-to-end proof today uses the Node's built-in capability.

The agent's side

$ btv-client call --cloud https://api.bytetraverse.com --org org_sh8v… \
    --endpoint nd-wnzh7ba3udyhsp7vfhmadtx6pm \
    --capability bytetraverse.com/files --version 1 \
    --scope-json '{"root":"/var/log/checkout"}' \
    --op read --lease-op read --lease-op list \
    --payload-hex a16470617468696572726f722e6c6f67 \
    --task triage-errors --agent oncall-bot \
    --id-token-file agent.jwt --key-file agent.key --repeat 3
lease lse_3s3e28jt97kb6cq643dzvmxxqk for bytetraverse.com/files
task triage-errors for agent oncall-bot
call 1: ok in 41 ms
call 2: ok in 38 ms
call 3: the Node closed the stream: Revoked
$ echo $?
3

The payload is { path: "error.log" } in deterministic CBOR. Output lines are as btv-client prints them.

05Every call is on the recordToday (tests)

The Node writes one event per open and per call, refused ones included, chains them by hash and delivers them signed. Only the scope and request fields the capability marks for audit, such as a file path, and never the contents of a payload.

Audit event, decoded

seq           1042      prev_hash  9f2c…c07d
principal     prn_fbf5…  (agent)
acting_for    [human, prn_hy43…]
asserted      [agent, oncall-bot], [task, triage-errors]
capability    bytetraverse.com/files  version 1
operation     read
scope         { root: "/var/log/checkout" }
lid           lse_3s3e28jt97kb6cq643dzvmxxqk
path_kind     direct
result        permit · ok · 41 ms
payload contents: never recorded

06Revoke itToday (tests)

The Cloud pushes the revocation over the Node's outbound channel. The Node puts it in force on every live session before it acknowledges, and the agent's next call is refused. In the end-to-end tests that happens within five seconds, on one machine, over loopback. Production timing is not measured yet.

POST /v1/orgs/{org_id}/revocations, then the agent

{ "kind": "lease", "target": "lse_3s3e28jt97kb6cq643dzvmxxqk",
  "reason": "task finished" }

call 3: the Node closed the stream: Revoked
$ echo $?
3

07How a lease only narrowsToday (tests), property-tested

A lease is a biscuit token signed by the Cloud's issuer and bound to the holder's P-256 key. Every block appended to it can only add checks, so a holder can narrow it for a task and never widen it. The Node verifies it by itself, offline: issuer, endpoint, expiry, revocation and proof of the key.

One lease, three blocks, example

block 0  signed by the Cloud's issuer
         bytetraverse.com/files  read, list, stat
         root /var/log/checkout        15 min   bound to the agent's key
block 1  added by the agent for one task
         task triage-errors, agent oncall-bot
         read                          5 min
block 2  appended by the holder, trying to widen
         write                         24 h     adds nothing the Node honours

the Node permits  read within /var/log/checkout for 5 minutes

08Write your own capabilityToday (tests), Unix

Declare the operations and a scope schema. The Node enforces both before your code runs, and runs your provider as its own user.

sdk/python/examples/notes.py, excerpt

from bytetraverse_provider import (
    define_capability, operation, serve,
)

notes = define_capability(
    id="bytetraverse.com/notes",
    version=1,
    operations=[
        operation("list"),
        operation("read", shape="server_stream"),
        operation("append", shape="client_stream",
                  risk="online_approval_required"),
    ],
    scope={
        "type": "object",
        "required": ["root"],
        "properties": {"root": {"type": "string", "maxLength": 256,
                                "x-btv-narrow": "path-prefix"}},
    },
    audit=["root"],
)

@notes.handler("list")
def list_notes(call):
    # the scope was checked against the lease before this runs
    root = call.scope["root"].rstrip("/") + "/"
    return sorted(p[len(root):] for p in STORE if p.startswith(root))

09The claims ledgerEach claim names the command that checks it

A claim counts as proven only when its command passes against that exact source. The claims behind this page:

client.m1_end_to_endan agent gets a lease, calls a Node, and is refused within five seconds of a revocation
authority.delegation_only_narrowsa narrowed lease permits exactly what its parent and its narrowing both permit
delegation.task_lease_attributeda task lease is enforced and its audit event names the agent, the task and the person
node.revocation_in_force_before_acka revocation is in force on every live session before the Node acknowledges it
node.providers_served_and_auditedevery open and call is in a hash-chained audit spool
node.state_encrypted_at_restthe Node keeps its state in one database encrypted at rest
provider.sdk_contractthe TypeScript and Python SDKs pass the provider contract tests
session.managed_relay_path_in_audita session runs direct or through an encrypted relay, and the audit says which

Have private systems that AI, apps or people need to reach?

We are looking for the first teams to run ByteTraverse on a real system. Tell us who needs to reach what.

Email us

Let AI, apps and people use your private systems. Never your network.

Today, access means the whole network.

A network

A key that lasts

AI makes it risky

Connect to the capability, not the network.

One platform for everything private.

Who connects

What you control

What you can connect

Every grant is exactly what it needs. That is what makes it safe to say yes.

Only what you name.

It ends on its own, and only ever narrows.

Every call is on the record. Stop it at any moment.

It runs beside your systems, and only dials out.

Built for jobs like these.

An AI product inside a customer's systems

An on-call agent during an outage

A button that needs a second person

A CI job with no stored secret

An agent that hands a sub-agent less

“What can this agent do?”

A contractor for an afternoon

Network access hands over a network. Capability access hands over one capability.

VPN or mesh for example Tailscale

SSH key or API key

Access gateway or bastion

ByteTraverse

Where it stands.

Who connects

What you control

What you can connect

Where it runs and how it reaches

Not claimed

For engineers.

Have private systems that AI, apps or people need to reach?