Product
Introducing Agent Studio: Where Agents Get Certified Before They Ship
Written by
Dilip Namdev
Published
August 2026
Reading time
8 min read
Most agent platforms end at deployment. The interesting problems all start there: which version is live, what did it actually do, and who is accountable when it is wrong.
Almost every agent platform is generous at the start and quiet at the end. Building an agent is well served: a persona, some tools, a prompt, a knowledge base. Then it ships, and the platform stops having opinions at exactly the point where the operational questions begin.
Which version is live. What it did on Tuesday and why. Whether the prompt somebody edited last week was ever evaluated against anything. Which of the fourteen agents now running is responsible for the call that went wrong. Who it was acting as when it read that record.
Agent Studio is built around the assumption that shipping the agent is the halfway point, not the finish line.
The lifecycle, and where the unusual parts are
- Create. An identity and persona, the tools it may call, the skills it carries, and its duty: conversing with people, or pursuing a purpose autonomously. Assembled in one place rather than spread across a config file, a prompt and a permissions console.
- Engineer the prompt. Behind every agent sits a prompt, and the studio treats prompts as source code with a workshop of their own. Authored with AI assistance, versioned, exercised against real models in a playground, and certified through structured evaluation rather than by whoever last had an opinion.
- Ground it. Managed knowledge bases, short and long term memory that can be shared between agents, and connections to external systems through governed integrations. An agent acting on model folklore rather than your reality is not a subtle failure, it is a confident one.
- Ship it. A release process with certification gates, agent-to-agent invocation in both directions, and an orchestration layer beneath single agents for tasks that need several.
- Operate it. AgentOps: how every agent performed on every task it ran, drill-down into each step it took, which models and providers were behind it, and a triage feed for the ones that need attention.
Steps two and five are where this differs from most of the category, and they are the same idea applied at different ends. A prompt you cannot version and evaluate is a production dependency with no change control. A fleet you cannot inspect per task is a set of processes doing things in your name that nobody is watching.
The perimeter, and why it is not on the agent
The governance question people expect is "how do you stop the agent doing something bad?" It is the wrong question, because it puts the safety property inside the thing whose behaviour you are trying to constrain.
Agents in the studio operate inside an enforcement perimeter rather than on trust. Prompts are screened before they reach a model. Every call runs as the calling user and nothing more, so an agent never has authority its invoker lacks. Data access is filtered attribute by attribute rather than granted wholesale at the connection.
The agent reasons. The governed layer acts. Nothing about the agent quality changes what it is permitted to do, which is the point.
This is the same separation that runs through everything else we build. Sentinel diagnoses but does not execute; ProcBot executes but does not decide; Sherlock verifies but authored none of it. The reason a regulated buyer engages with the architecture at all is that no single component both chooses an action and carries it out. We set out the general form in what an Action Ticket is, and the components version in introducing the SRE Agent.
When you would actually use it
Not for the operations patterns. Sentinel, ProcBot and Sherlock already cover those and building your own version would be work for its own sake. Agent Studio earns its place when the agent you need is one we could not have written: a process specific to your business, a domain with rules that live in your company and nowhere else, or an internal workflow that would be modelled wrong by anyone outside it.
The honest test is whether you can describe the agent duty in a sentence that includes something proprietary. If you can, the studio is the right tool. If the sentence would apply to any company in your industry, we probably already ship it.
The full lifecycle, including AgentOps and the enforcement perimeter, is on the Agent Studio page. The list of actions no agent we build is permitted to take alone is in what we will not automate, and why.
Frequently asked questions
Do we need Agent Studio to use the platform?
No. Sentinel, ProcBot and Sherlock ship with the platform and cover the operations patterns. Agent Studio is for the case where you want agents we did not write: a process specific to your business, a domain we do not know, or an internal workflow nobody outside your company would model correctly.
What does certification actually gate?
The release. An agent moves toward production through a process with certification gates rather than a deploy button, and a prompt is exercised against real models in a playground and checked by structured evaluation before it counts as certified. The point is not that certification proves an agent is correct. It is that the version now running is one somebody deliberately approved, which is a lower bar and the one most agent deployments fail.
How is prompt versioning different from just keeping them in git?
Git gives you history. What it does not give you is the ability to exercise a specific version against a real model, compare it against the one currently live, and attach the evaluation result to the release record. Treating prompts as source code means the tooling around them, not just the storage.
Can agents call each other?
Yes, in both directions, and there is an orchestration layer beneath single agents for the cases where a task needs several. That is also the point at which governance stops being optional: an agent invoking another agent invoking a tool is exactly the chain where an unbounded permission becomes an incident, which is why every call runs as the calling user and nothing more.