Every change can be put back. Before an agent updates or deletes a record through the vault, PhysicsBase keeps an encrypted copy for 30 days. Each change gets an Undo button: restore the old fields, delete what it created, or refund a Stripe charge.
Rewind. Undo everything an agent changed in the last hour, day or week in one go. The agent is paused first so it can't redo it. Anything that can't be undone (messages sent, money moved) is listed for a person.
Autonomy levels. Read-only, propose, undoable-only or full, per agent or per enrollment key. At "undoable only", an agent works on its own and only irreversible actions wait for one approval, with a plain-English preview. Existing agents stay at full.
In the copilot. Ask "what did lead-bot change today?" or "undo what it did in the last hour".
: Plans
Free, Team, Business and Enterprise. Every plan keeps every security feature. Team ($99 a month) and Business ($499 a month) add more agents, more requests, longer history, Slack approvals, incident reports, log streaming and policy as code from CI. Yearly billing gets two months free.
Never cut off on a paid plan. Past the limits it's $5 per extra agent and $2 per 10,000 requests, on the next invoice.
Early users keep their limits. Organisations created before today keep 25 agents, 100,000 requests and every feature for six months.
: Two owners per agent, permission drift and readable decisions
Owners, sign-offs and verdicts are all optional. Skip them and nothing changes.
A technical owner and a business owner. Each agent can have a written purpose, a technical owner (logs, permissions, kill switch) and a business owner (does what it decides match the workflow?).
Permission drift. Sign-offs snapshot what an agent actually does. A new kind of call, a policy change or an overdue review is flagged, listed and alerted, along with permissions it never uses.
Reviews as a deployment artifact. Export the review as Markdown to keep in git, and fail CI with physicsbase-agent review --check when an agent has drifted.
Decisions in plain language. Every change is explained in a sentence with the amount and the agent's reason, in the log, on the agent's page and in incident reports.
Business verdicts. The business owner marks decisions as matching the intent or wrong for the situation. Wrong calls alert the team.
“Say why” rule.require_reason refuses writes that don't give a reason.
: Spend caps, data-leak rules, Slack approvals and a playground
Model spend caps. Every call to OpenAI, Anthropic, Gemini, Bedrock or an OpenAI-compatible API through the vault is priced from the tokens it used, streamed or not. Each agent shows its spend today and this week. An llm_budget rule caps it per day, and can pause the agent when it crosses the line.
Watch-only rules. Try any rule on live traffic first: nothing is blocked, and every call it would have refused is logged. Switch it to enforcing with one click.
Data-leak rules. Refuse requests carrying card numbers, IBANs, US Social Security numbers, API keys or email addresses. Card numbers and IBANs are checksum-verified, so order numbers aren't caught.
Duplicate protection. Refuse an identical request repeated within a window: no more double refunds from a retry loop.
Approvals in Slack. Checkpoints arrive in Slack with Approve and Deny buttons, for the people you list. Signed, logged, and the message updates to say who decided.
Incident reports. Export what an agent and its sub-agents did in any window, as Markdown or JSON, from its page or the API.
Shadow-agent scan.physicsbase-agent scan --github your-org finds which repositories run agents and which hold API keys in plain text.
From your own terminal. The homepage gives you a curl command. Run it and your request goes through the real checks, your terminal gets the answer, and the page shows it the moment it lands.
The 3 a.m. loop and the kill switch. Watch a looping agent burn $1,080 with a pasted key while the same agent behind a spend cap stops at $25. Then hold one button and the whole page stops.
Try to break it. The homepage has a live refund agent to attack: steal its token, replay a request, forge more access, leak a card number. Every check runs on the server with the real code.
: Copilot, request rules and anomaly detection
Copilot. Press ⌘K in the dashboard and ask about your agents in plain language: what happened, who was refused and why, who is busiest. It can pause, resume, limit or revoke agents, set request rules and answer checkpoints. Every change is a confirmation card; revoking needs a press-and-hold. Free with a Groq key; also Gemini, OpenRouter, Ollama, Claude or any OpenAI-compatible model, with an offline mode when no model is set.
Request rules. Look inside each call: allowed methods and paths, forbidden paths, a cap on an amount per request, a daily budget, working hours. JSON and Stripe-style form bodies are both read.
Pause. Stop an agent without revoking it, and resume it with one click.
Anomaly detection. Bursts far above an agent's normal rate, refusal storms and first use of a new API. Per enrollment key: alert, pause automatically, or ignore.
Sub-agents and task agents.agent.delegate() hands a narrower identity to a sub-agent or a single task. It can never exceed its parent, expires on its own and stops when the parent is paused or revoked.
Connector catalogue. Templates for Stripe, OpenAI, Anthropic, GitHub, Linear, Jira, Slack, Google Workspace, Notion, HubSpot, Salesforce, Twilio, SendGrid, Resend, Shopify, Airtable, Datadog, Amazon Bedrock and any REST API.
OAuth connections. Sign in to a provider once (authorization code with PKCE) or use client credentials. PhysicsBase refreshes tokens before they expire.
Agent timelines. One page per agent: hourly chart, what it touched, every event and its sub-agents.
Policy as code. Export every policy as one file, preview the diff and apply it, from the dashboard, the API or physicsbase-agent policy.
Log streaming. Datadog, Splunk HEC, OpenTelemetry (OTLP/HTTP) or a signed HTTPS endpoint.
Key scanner.physicsbase-agent scan . --vault finds API keys in code and moves them into the vault.
Framework tools. One physicsbase_request tool for OpenAI, Anthropic, Vercel AI SDK, LangChain and CrewAI.
One-click installs. Add the hosted MCP endpoint to Cursor, VS Code, Claude Code or Claude Desktop from the new-key screen.
: Hosted agents, teams and the vault
Hosted MCP endpoint and proxy: connect any agent with one URL and an enrollment key, nothing installed.
Organisations with owners, admins and viewers; management API tokens; alerts to email, Slack and signed webhooks.
Credential vault with Web Bot Auth signatures; owner dashboard; move-host tools.
PhysicsBase