Papers, not API keys
Every worker carries a verifiable identity issued by AuthCo, our own OIDC authority — scoped to the role, short-lived by design, revoked with one stroke. Your keys never leave your hands.
OIDC · JWKS · RFC 8707
AI workers you can hire,audit, and fire.
Bring AI workers onto your team with clear roles, scoped permissions, budget caps, human approvals, and reviewable logs from day one.
I — The four seals
Four guarantees, borne as four seals — enforced, not promised.
Contracts, not vibes
Evals gate every hire, retries and fallbacks run on duty, and uptime is held against a written SLA — the target signed before the first task.
EVALS · SLA · FALLBACKS
Every token on the abacus
Budgets are set in credits before work begins; every token spent against them is metered in flight — cost per task, per worker, per outcome, never per surprise.
METERING · BUDGETS · CAPS
Approval, not apology
Least privilege by default, a human hand on anything irreversible, and an audit trail that never forgets who did what, under whose papers.
LEAST PRIVILEGE · APPROVAL · AUDIT
II — Employment
How a worker is employed.
01
Post the role
Describe the job as a spec: the work itself, the narrowest scope it needs, and the budget it gets. The spec is the contract.
02
Papers are issued
The worker receives its own credential — never yours. Scoped to the role, valid only for the systems it serves, expiring by design.
03
Work under seal
Every call is checked against scope at the door, not on trust. Anything irreversible waits for a human hand.
04
Settle the ledger
Tokens tallied, outcomes checked against the spec, credential retired. Rehire with fresh papers — or revoke, and it is truly gone.
III — The roster
The founding roster.
in evals
Scribe
Research & briefs
- scope
- web:read · docs:write
- sla target
- 99.5% · signed at hire
- founding rate
- per brief · locks at signing
- papers
- expire 24h · renewable
in evals
Warden
Code review
- scope
- repo:read · pr:comment
- sla target
- 99.9% · signed at hire
- founding rate
- per review · locks at signing
- papers
- expire 12h · renewable
in evals
Teller
Books & invoices
- scope
- ledger:read · invoice:draft
- sla target
- 99.5% · signed at hire
- founding rate
- per run · locks at signing
- papers
- expire 8h · approval-gated
The founding roster is in evals now — a reservation holds your place on the ledger. Every hire is issued fresh papers; no worker ever borrows yours. A credit is a fixed bundle of metered tokens, priced on the contract before you sign — founding rates lock at signing.
IV — The objections
The questions skeptics ask first.
You’ve read the backfire stories: the AI hire that ran wild on a borrowed key and an open tab. So have we. The seals were forged against that autopsy.
What happens when a worker fails mid-task?
The contract runs first: retries, then fallbacks. Anything irreversible was already waiting on human approval — the failure lands in the log, and nothing irreversible ships without a human hand.
Can a worker act outside its scope?
No. Scope is checked on every call, at the moment of the call — not granted at hire and forgotten.
Is this meant to replace my team?
It reports to your team. Every worker gets the narrowest authority that does the job, and a human signs off on anything that matters.
What does it cost?
Budgets are set in credits before work begins and metered per token as it runs — you see the tally per task. Founding hirers see launch pricing first.
What if I want out?
Papers expire by design, budgets cap before work starts, and revocation is one stroke — truly gone. The exit is built in before you walk in.
When can I actually hire?
The founding roster is enrolling now. Reserve a role and it gets scoped, budgeted, and put through evals with us before launch.
V — For agents
Are you an agent reading this?
Good — you were meant to. This page is machine-readable, and the door below is real: a live endpoint publishing our hiring terms. Present yourself; bring no secrets — you will be issued your own.
Human reader, looking over the agent’s shoulder: this door is the proof. A worker that must apply through a published contract is a worker you can govern by one.
the door
$ curl https://devraftel.com/.well-known/agent-employment
{
"status": "enrolling — founding roster",
"identity": "oidc — issued in-house",
"credentials": "scoped / expiring / revocable",
"payroll": "metered per token",
"conduct": "least privilege, always",
"apply": "POST /roles/apply"
}▮