Isolated execution platform for AI agents · installed on your own infrastructure
Isolated workspaces,
borrowed as needed,
on your own infrastructure
AI agents, generated code and people's work — in isolated execution spaces (enclaves) inside your own infrastructure. It can be erased, but it cannot be seen.
What it lends
Isolated execution space, storage and usage limits
Each application (a business system or an agent) borrows with one API key and shares it out to its own users — the way one database account serves many business users.
Enclave
An isolated execution space with a shell, CPU and memory. From a few seconds of code execution to staying resident around the clock.
Workspace
Storage that stays after the enclave is turned off. It is attached again to the next conversation or the next job.
Templates by use
A template fixes resources, isolation level, lifetime, outside-connection scope and browser slot in one go — «resident», «short-lived», «chat workspace». A template that asks for a capability the infrastructure does not support is never created.
AI model usage limits
Each workspace is given AI model access and a limit. The access key never enters the workspace.
Where it is used
Where agents work, code runs and files stay
An AI agent that works around the clock for each employee
It stays resident in one enclave — Y-Pair runs on top of this.
Letting outside coding agents in, isolated
Not blocked: they are allowed out only to the code repositories and package sites you permit.
Running and previewing generated code
Run untrusted code briefly and throw it away.
File context for AI chat
Even after the conversation ends, the files stay in the workspace.
Batch jobs
Keep the data in the workspace and borrow only the computing.
One way out
All traffic passes through one exit
A workspace cannot see the outside directly. All traffic passes through one Y-Enclave exit (the choke point to the outside), and what to open is decided by the «exit settings» of each template.
No way out
Code execution and computing only. There is no path to the outside.
Action gate only
Only the path for an agent's tool calls and to the AI model server is open. This is the default for a resident agent.
Up to what is allowed
On top of the action gate, only to the sites, methods and addresses you allow. Blocked attempts are counted as operational events.
What the action gate does
- It judges an agent's tool calls before they run — allow, deny, or ask a person.
- What to ask about is set by the application as a rule bundle. The action gate does not know business like mail or approvals; it only enforces the rules it is given.
- A judgment records only what was judged and how, and keeps no call content.
The floor rule under every rule bundle
- Actions that can't be undone or are visible outside, and tool definitions that are not trusted, are always asked about.
- This property is proven across all requests, not tested on a few — the rules are turned into mathematical logic formulas and checked with a proof tool (SMT).
- If an error occurs while judging a rule, the action is denied, not allowed.
What the operator sees
Resources and limits, and only the kinds of things that happened
Promise
What we guarantee, and what we can't
We write down separately what we guarantee and what we can't.
Not possible by design
Operator screens and management tools have no feature for opening, or copying away, the files, screens or conversations inside a workspace.
A workspace tied to a key on the user's device does not open without that device's signature — neither the application that borrowed the workspace nor the operator can open it (by design).
Blocked and recorded by policy
By default, the ways for a server administrator to connect directly to a workspace or look in with a debugger are closed, and changing that setting is recorded and announced.
A workspace connects to the outside only where it is allowed.
You can verify it
There is a proof that the floor rule of the action gate always asks about risky actions, delivered in a form the customer can run again themselves.
Check scripts confirm that what is installed matches what was built from the published source, and that an administrator account's connection to a workspace is refused and recorded.
What we can't guarantee
It is not hardware-based confidential computing (TEE). The isolation today is software isolation and a no-viewing design.
If the subject loses both their device and the recovery kit, neither the company nor iyulab can bring it back. Even when something fails, we do not offer support that looks inside an enclave to fix it.
The company can do the erasing — destroy a workspace's encryption key and the data can no longer be read.
Installation
It stands on your own infrastructure
Even the management server is installed on the company's infrastructure. It doesn't lean on outside services and keeps working to the end in an air-gapped network cut off from the internet.
At installation we measure what the infrastructure can do and tell you in a capability report, and we promise only within that range. If a requested level of isolation can't be met, we don't quietly lower it.
The AI model is simply the model server the company already uses (OpenAI-compatible).
Frequently asked questions
Questions you may have, answered up front
Can the company audit an agent's records?
Operational records are kept only as closed fields: type, number and time. Files, screens and conversation content inside an enclave are designed not to be kept centrally (by design). Operational events such as an attempt blocked by a rule or a limit being reached are recorded without content. If you are looking for a way to record every activity including its content, this may not be a fit.
Does it work in an air-gapped network?
It is designed to be installed and to run without the internet (by design). The full check passes on a network with no path to the internet. How an air-gapped setup is arranged in a customer environment is covered in an adoption consultation.
Contact us
Tell us what you want to hand over and your installation environment
Someone will walk you through the scope and the schedule.
Inquiries are collected in one place, on the Y-Pair page.