Permission gates
Allowlists and approval checkpoints enforced by the runtime. A denied action cannot be argued into happening — there is no path where the model talks its way through.
Building for launch
Autonomous agents, held to human-grade controls.
lb2k is building the permission, credential, and audit layer that lets autonomous agents act on systems where mistakes cost money — and makes every action reviewable afterwards.
Early-stage. The platform below runs today and is opening to design partners.
The problem
Giving a model a tool is easy. Trusting it with one is not.
Most agent stacks treat permissions as prompt instructions — a sentence asking the model to be careful. That is not a security boundary; it is a suggestion.
When the tool moves real money, a suggestion is not enough. You need limits the agent cannot argue with, credentials it cannot read, and a record you can audit months later.
That layer is what we build.
The platform
Four controls, enforced beneath the agent.
Every one of these lives outside the model's reach. The agent proposes; the system decides what is allowed to happen.
Credential isolation
API keys live in a secrets manager and are injected only into the child process that needs them — never into model context, never into a transcript, never into a log.
Complete audit journal
Every action attempt — executed, refused, or dry-run — is written append-only with its parameters and outcome. "What did it do last Tuesday" has an answer.
Blast-radius caps
Hard value limits per action and per day, enforced in the tool server. The agent has no tool that can widen them, so a runaway loop hits a wall instead of your balance.
Isolated environments
Each agent runs in a reproducible, declaratively-defined environment with its own tools and its own gate. Separate trust domains, versioned as config.
Operator visibility
A live, read-only view of what agents are doing right now — served inside the authenticated control plane, with no separate surface to secure.
Where we are
Working, not theoretical.
The platform runs today against a live exchange testnet, built to prove the boundary before anything real touches it.
| Component | What it does | Status |
|---|---|---|
| Agent profiles | Reproducible, layered agent environments defined as config — each a separate trust domain. | in use |
| Approval gates | Read-only tools allowlisted; anything state-changing requires an explicit human decision. | 66 assertions passing |
| Tool server | 16 market-data and order tools behind hard value caps, with a full audit journal. | testnet only |
| Secrets | Vault-backed credential injection, supervised and unsealed automatically at boot. | operational |
| Operator UI | Live read-only view of agent activity, inside the authenticated control plane. | operational |
We killed a feature on evidence. We built the trading harness, then backtested the strategy it would run. The result showed no edge over simply holding — so we shipped nothing and left it pointing at a testnet.
A safety layer is only worth anything if it stops us too.
Principles
How we build it.
- Defaults deny.A new capability is off until something explicitly turns it on.
- Enforce beneath the agent.Limits live where the agent cannot reach them, not in its instructions.
- Evidence over assertion.If a claim matters, there is a test or a log behind it.
- Kill it when the evidence is bad.A negative result is still a result.
An agent that can act is an agent that can act wrongly. The interesting engineering is not making it more capable — it is making its mistakes small, visible, and reversible.
So we treat the model as an untrusted component by default. It proposes, and the system disposes.
— The lb2k team
Get in touch
Building something that needs this?
We are opening the platform to design partners. Tell us what your agents touch.
adminbl@lb2k.com