Roadmap

​

The bet

• Judgement. Agents don’t know a team’s unwritten rules: what good looks like here, and what must never happen. Most of those rules live in a few people’s heads.
• Accountability. It is hard to prove an agent acted within bounds, who set the bounds, and who approved the exceptions.

​

The structure

• Owners make rules real. Anything mined or learned starts as a candidate, in watch. A rule stops actions only after its owner confirms it.
• Ask, don’t guess. When Claros can’t tell, it asks. Every answer becomes a precedent.
• Quiet by default. Most moments: silence. Questions are budgeted and timed to pauses.
• What leaves the device is a check, not a recording. No continuous screen or audio capture.

​

Now

• Agents, guarded. npx getclaros wires MCP clients (Claude Code, Cursor, Claude Desktop, VS Code, Codex), Playwright, browser-use and Pomerado servers (apps with no API), plus native hooks for coding agents (Claude Code, Codex, Cursor) so shell commands and file edits are checked too. Every action is checked before it runs: stopped, nudged with the fix, or held to ask. With 0.5.0: npx getclaros finds, guards and proves every agent on the machine in one command, getclaros status, and a heartbeat so Your agents shows an agent before its first write.
• Rules in. Connectors (preview) turn decisions into suggested rules with inferred owners; documents are drafted sentence by sentence; Add a rule in one sentence; a voice recording (optional); and owners’ answers become precedents, then proposed rule versions. Mined, drafted and learned rules start in watch (a drafted policy can skip it with Approve and enforce now); a rule you add is live at once when it’s personal or you’re an editor, and a member’s team rule runs in watch until an editor confirms it.
• Checks. Stop, ask or nudge across a whole workspace, “can’t tell” instead of guessing, and overrides that feed rule changes the owner confirms. The same action is never asked twice, and the judge sees the most similar past decisions of each rule. See The judge.
• The ask loop. An ask goes to the person, then the rule’s owner, where they are: the Mac notch, a Slack DM or email, with a signed one-tap link that answers once, and escalation to the admins when nobody answers. The answer is an approval record and a precedent, and the waiting agent gets the decision. Three consistent answers propose a new rule version, which runs in watch first.
• Agent identity. Each check names the agent and the person it acts for, from the credential. A person’s agents ask that person first; Your agents in the app is one timeline per person. Members create their own agent keys.
• Evidence. Complete check rows (rule version and hash, who confirmed it, did it run), one hash chain per workspace with Ed25519-signed checkpoints and getclaros verify, a SIEM stream, an AIUC-1 evidence pack that states its gaps, an oversight report per owner, a signed monthly report, a This week card on Home and a printable weekly report. See Evidence.
• Rules travel with the work. Exports to AGENTS.md, DESIGN.md-style files and Agent Skills.
• Benchmark. +16 pts over repo docs, +24–29 over RAG, on both sets. Methods and caveats: Rules benchmark.

​

Preview

• Connectors (company). Slack, GitHub, Google Drive and Directory, Notion and Linear by token or OAuth, or their exports; Claros mines candidate rules with owners and sources, and owners review them in one keyboard table. Tested against mocked APIs and exports, not yet real workspaces. See Connectors.
• Claros for Mac (person). An unsigned preview: the notch, Accessibility only, on-device redaction. Clicks are warned, not blocked; ⌘↩ is held and dropped on a stop. It also shows your agents’ stops and asks in the notch, lets you decide your agents’ asks there, and enrolls your agents in one click. See Claros for Mac.

​

Next

1. Real workspaces. Connector syncs against teams’ own Slack, GitHub, Drive, Notion and Linear, and the “20 candidates in under 10 minutes” review measured.
2. Claros for Mac, signed and always on. A Developer ID signed, notarized app, launch at login by default, an honest Quit dialog, “Your Mac: offline since…” on Home, voice answers, and commit detection tested on live apps.
3. Prevent, don’t apologise. Every rule declares whether it prevents or detects; drafts checked while they’re written so Send hits a ready answer; holds only with a reason (press again, never replayed); fast on-device checks; break-glass with a reason; tracked remediation for detect rules; a browser companion for web forms; hard gates in the system of record; agent edge cases (parallel calls, reworded retries).
4. Capture that keeps up. Capture means observing decisions (answers, overrides, break-glass reasons, reviews, reverts, corrections of agent work), never an always-on microphone; voice stays an input you choose. Planned: redaction before mining; corrections of agent work as taste signals; a precedent-vs-rule threshold and stale-rule detection; a weekly “still true?” digest per owner; push-to-talk answers in the notch; delegation and reassignment for absent or departed owners; an employee notice template and a “What Claros reads” page; rule provenance with source links; and learning from corrections you give your coding agents, opt-in.
5. One Claros across every surface. Sign in once; one status line on every surface with one fix button; one settings home; setup checklists that tick themselves; each role sees only what it can act on; plain words everywhere; a “What Claros sees about you” page; an admin Health board.
6. Evidence, hardened. Per-agent cryptographic identity, sub-agent delegation, scheduled pruning.
7. Production. Managed hosting, SSO / SCIM and SOC 2.

​

Later

• Continuous evidence for insurers and certifiers, in place of one-off snapshots: the record agent work is insured and audited on.
• Native controls that don’t need a model: spending caps, rate limits, maker ≠ checker.
• Rules that travel further: two-way sync with design tools, and guards in front of their write calls.
• Judges that get better with use, with false-stop, miss and override rates measured over weeks on real teams.