Architecture/How the runtime is built

One runtime between your agents and the world.

Your framework decides what to do. Invoke owns what happens next — identity, policy, coordination, memory, receipts, observability and governance, applied to every call, on the same path the call already takes. No framework migration, no rewrite.

Read the docs →Request lifecycle
The seven planes

Each plane owns one property, and enforces it.

These are not modules you assemble. They are the concerns that every production agent system grows anyway — usually as seven half-built versions scattered across a codebase.

01

Identity

Resolves every call to an actor, a workspace and an org before anything else runs. Agents get their own revocable keys rather than sharing a human's credentials.

Primitive · Actor

keys · inv_… · SHA-256 digests · per-agent rotation

02

Policy

Evaluates the intended effect against your rules — allow, deny, or escalate to a human. It runs inside the call path, so there is no route to the network that skips it.

Primitive · Decision

allow · deny · require_approval · evaluated per call

03

Coordination

Hands exclusive ownership of a unit of work to exactly one agent. A conditional claim in the database settles the race, so parallel agents don't duplicate each other.

Primitive · Claim

tasks · claimed_by · atomic conditional UPDATE

04

Memory

Shared, versioned context between agents. Reads carry a revision number and a contested flag, so an agent can distinguish settled context from a value two writers are fighting over.

Primitive · Revision

memory get/set · revision · contested

05

Receipts

Seals each execution into a signed, chained record. The receipt is portable evidence — verifiable by anyone holding it, without access to your account.

Primitive · Receipt

HMAC-SHA256 · prev_receipt_hash · /receipts/{id}/verify

06

Observability

One append-only, hash-chained ledger is the source of truth. The live console and the audit export are both folds over it, so what you watch is what you audit.

Primitive · Event

append-only ledger · /ledger/verify · replay

07

Governance

Budgets, approvals and limits — the controls a human sets and an agent cannot edit. Exhausted budgets and pending approvals stop execution at the gate.

Primitive · Budget

token + spend budgets · approvals · fail closed

Request lifecycle

What happens between the decision and the effect.

One tool call, all the way through. Steps 05 to 07 are the gates — the only places an execution can be stopped. Steps 09 and 10 are why you can prove any of it later.

  1. 01The model decidestool_callYour agent emits an ordinary tool call. Nothing about your framework changes — Invoke is on the other side of the call, not inside your prompt. This is the last moment the model is in charge.
  2. 02Identity resolvesactor · workspace · orgThe agent’s key is hashed and matched to an actor, workspace and org. Scope is bound here and applied to everything downstream, which is what makes cross-tenant access a 404 rather than a check someone can forget.
  3. 03The effect is keyedeff_<sha256>The tool name and canonical arguments are hashed into a stable effect key. Two attempts to do the same real-world thing produce the same key — this is the hinge the exactly-once guarantee turns on.
  4. 04Deduplicationexecution.deduplicatedIf that key already has an execution, the runtime returns the original result and records a deduplication event instead of running it again. A retry storm after an ambiguous timeout produces one charge, not six.
  5. 05Budget checktokens · spendToken and currency budgets are evaluated before execution. An agent that has burned its workspace budget stops here — the difference between a blocked call and a surprise invoice.
  6. 06Policy evaluationallow · deny · require_approvalYour rules run against the resolved effect: the actor, the tool, the arguments, the resource it touches. The outcome is recorded whichever way it goes — denials are evidence too.
  7. 07Human approvalsuspend → approve | denyWhen policy demands it, the execution suspends and the effect parks in pending. A human approves in Mission Control or Slack, and their decision joins the ledger with their name on it. Irreversible actions wait; the rest never gets here.
  8. 08Executioncredentials attached in-runtimeThe runtime attaches the connector credential and makes the real call. The model never saw the key — it only ever named the tool. Receipts record secret_exposed_to_agent: false.
  9. 09Sealedhash → sign → chainThe result is canonicalised, hashed, signed with HMAC-SHA256, and chained to the previous receipt. From here the record is tamper-evident: altering it means re-signing everything after it.
  10. 10Observedfold · replay · diffThe event lands in the append-only ledger. Mission Control folds it into the live view, and foundry replayre-runs the fold at any earlier point — so “what did this agent know at 3 AM” is a query, not an archaeology project.
Deployment topology

Local by default. Shared when a second human shows up.

Foundry

Your machine

Runs where your code runs — laptop, CI, or your own infrastructure. Policy evaluation, identity, deduplication and the receipt chain all work with no network dependency, and the ledger is a file on your disk. This is the whole product for one engineer, and it is free to run.

Crosses the boundary

Nothing, until you run foundry push.

Invoke Cloud

Hosted

The shared plane: one ledger your team can read, approvals that reach a human on Slack, org-wide policy, and budgets that hold across agents. You move here when the answer to “what did the agent do” needs to reach someone who is not you.

Crosses the boundary

Execution metadata and receipts. Not your database, not your source. See /security.

Migration cost

The same receipts, the same verification command, the same chain rules in both planes. Pushing a local workspace to the cloud does not re-shape your history — it publishes it.

Integration surface

Three ways in. All of them governed.

MCP

A workspace is an MCP server. Point Claude Code, Claude Desktop, Cursor or Codex at it and your tools appear as ordinary tools — governed on the way through, with no client-side changes.

Best for

Coding agents and desktop clients

SDK

Wrap the tool call you already make. The OpenAI SDK, LangChain and plain HTTP services all keep their shape — you change where the call goes, not how your agent is written.

Best for

Services you own

Model proxy

Route model traffic through Invoke to capture token spend and reasoning alongside the effects it produced — so a receipt shows what the agent was thinking as well as what it did.

Best for

Cost attribution and full traces

Start local

Install Foundry.
Govern the next call.

Nothing to migrate, nothing to host. Run it on your machine and push when you are ready to share the ledger.

Start building →What we guarantee