Invoke is the runtime between your agents and your production systems. Everything below is a guarantee the runtime enforces — not a setting you remember to turn on — and every one names the mechanism behind it.
$ foundry receipts verify rcp_8f31a2c40b9e RECEIPT rcp_8f31a2c40b9eEXECUTION exec_7f31 · stripe.charge_customerACTOR agent:billing-bot · key inv_…4f21WORKSPACE acme / prod ✓ signature HMAC-SHA256 · valid ✓ receipt hash 3e9c…a71f matches canonical body ✓ chain link prev 0b42…c8d1 · intact ✓ ledger 1,284 events · no gaps VERIFIED sealed 2026-07-19T09:14:22ZA receipt is portable evidence. Hand one to an auditor, a customer, or the engineer asking why the charge went through at 3 AM — the signature and the chain answer without anyone taking your word for it.
Orchestration frameworks decide what an agent should do. These are the properties that hold once it actually does it.
Every effect is keyed by content hash — eff_<sha256>. A retry resolves to the same key, collapses into the original effect, and emits execution.deduplicated instead of charging the card twice.
Each receipt carries a canonical hash plus an HMAC-SHA256 signature, linked to its predecessor by prev_receipt_hash. Editing history means re-signing every receipt after it.
Policy evaluation sits inside the call path, not beside it. A tool call reaches the outside world only after the pipeline returns allow — there is no unpoliced route to the network.
Agents authenticate with prefixed, individually revocable keys. The runtime stores only the SHA-256 of a key, and stamps the resolved actor onto every ledger event it writes.
A task is claimed by a single conditional UPDATE … WHERE claimed_by IS NULL. The database decides the winner; every other agent gets already claimed and moves on.
Workspace memory keeps every revision, not just the latest value. Reads return the revision number and a contested flag when writers disagree, so an agent can tell stale context from settled context.
The ledger is append-only and hash-chained. The console is a fold over those events rather than a separate log, so what you watch and what you audit are the same record.
Token and currency budgets are checked before the effect executes. An agent that exhausts its workspace budget is stopped at the gate, not discovered on the invoice.
A matched policy parks the effect in pending and the execution suspends. The approve or deny lands in the ledger with its approver, so the decision is auditable years later.
Org scope is resolved during authentication and applied to every query. A cross-org identifier returns 404, never a permission error — the runtime does not confirm that another tenant’s resource exists.
Credentials are attached to the outbound request by the runtime at call time. The model sees the tool schema and the result — never the key. Receipts record secret_exposed_to_agent: false.
Foundry keeps a local ledger on disk and governs calls with no network dependency. foundry push promotes a workspace to the cloud control plane when a second human needs to see it.
A model that hallucinates a sentence costs you a retry. A model that hallucinates an API call costs you a refund, a customer, or a compliance finding. The intelligence layer improves on its own every few months. Execution reliability does not — it has to be built.
That is the entire job of the runtime: everything after the model decides what to do.
They require governance. Start local with Foundry, push to Invoke Cloud when a second human needs to see the ledger.