- Home
- Products and Trials
- Product: ASE
Agentic solution engineering
with operational discipline.
Elevate Your Vibe with ASE Precision.
Agents don’t just write code anymore. They stand up infrastructure, draft regulated documents, and plan work nobody can afford to get wrong. ASE is the self-hosted control plane that defines what they’re allowed to do, supervises them in real time, and produces a tamper-evident record of exactly what they did — whatever the solution is made of.
Software delivery. Platform engineering and IaC. Regulated document generation. A nine-day route through the backcountry. One engine, one evidence trail — built for the people accountable for what agents produce.
See ASE running against a real repo, a real stack, or a real document set. No deck.
Building or documenting for the DIB under CMMC? See ASE for GovCon & the DIB →
PocketTasks, built by a governed agent constellation.
Four short episodes, one real run: a small Python CLI app taken from a product brief to a completed, evidenced hand-off — entirely inside ASE.
From Intent to Governed Work
A product brief becomes a System Intent, a stack, a compliance plan, and decomposed work — all traceable back to the original ask.
From Constellation to Live Run
The plan becomes a governed agent constellation — specs reviewed, work assigned, and the run launched live.
From Live Run to Completed Work
Claims, leases, agent activity, and execution evidence, followed from a live run through to completed work.
From Completed Run to Operator Hand-off
The finished app runs and gets verified, then the final run record, its evidence, and the OTHOR hand-off artifact wrap the story up.
A fleet of ungoverned agents loose on your work is an operational risk.
ASE brings to agentic delivery what regulated workflow automation brought to business operations: identity boundaries, versioned definitions, approvals, tamper-evident audit, evidence reporting, and recovery paths — in one product surface your engineering and compliance teams can both stand behind, no matter which kind of solution the agents are building.
Agents are already producing your deliverables.
Copilot, Cursor, Claude Code, and custom agent scripts are writing code, generating Terraform, and drafting documents across your organization right now. None of that activity is captured in your existing change-control database.
Improvised prompts, missing evidence.
Prompts are ad-hoc. Reviews are manual and best-effort. Event logs are scattered across vendors. There is no single, chain-hashed record of what the agents decided, which models were invoked, and who approved the result — whether that result was a merge, a plan apply, or a signed document.
Govern agentic workflows with structural discipline.
ASE establishes the central control plane for multi-agent execution. It captures work definitions, approval gates, runtime leases, and tamper-evident audit trails that map directly to your existing IT controls and regulatory requirements — independent of the domain the work lives in.
Software was just the first domain.
A domain in ASE is a vertical pack — a versioned set of definitions, gates, and evidence rules. Adding one is a configuration exercise, not a fork of the product. The governance, the supervision, and the audit trail are identical whether the artifact is a pull request or a permit-constrained itinerary.
Code, with the receipts.
Greenfield builds, feature work, and legacy-parity conversions on real repositories — claims, leases, merge gates, and attributed commits. BogMem is the flagship parity conversion we shipped this way, and the git history is the audit trail.
Infrastructure is a solution too.
Terraform, Bicep, Helm, and pipeline definitions authored under the same discipline — environment topology captured as a versioned definition, plan output reviewed at a gate before anything is applied, and drift recorded as evidence rather than discovered in an incident.
PPP, SCG, SSP, POA&M.
Program Protection Plans, Security Classification Guides, and CMMC self-assessment packages drafted by governed agents, with your program’s designated markings applied deterministically to every page. ASE applies the markings — it doesn’t decide what’s controlled.
ASE for GovCon & the DIB →Week-long hikes. Backcountry. Day trips.
Multi-day thru-hikes, backcountry routes, and day hikes planned as governed work: permits and quotas as hard constraints, water carries and resupply as dependencies, weather windows and bail-out points as gates, and a gear list that ties back to the plan. Every assumption is on the record before you leave the trailhead.
If the work can be defined, decomposed, gated, and evidenced, ASE can govern it — that’s solution engineering, not software engineering.
One control plane, three kinds of accountability.
Different domains, same question: when someone asks what the agents did and who signed off, can you answer with a record?
Answer the hard question with a record, not a reconstruction.
When the board, an auditor, or an incident reviewer asks who approved what an agent did — and against which definition — you hand them a tamper-evident evidence bundle. Least-privilege launches, change-control gates, and a clear path to reproduce or revert any agent’s work. The same bundle whether the agent shipped a release, applied a plan, or produced a deliverable document.
Governed generation, inside your boundary.
Self-hosted and air-gap capable — agents can run entirely on local models, with no code, document, or prompt leaving your network. Provenance for the code in your CUI-handling systems, marked PPP and SCG drafts, plus a built-in CMMC Level 1 & 2 self-assessment workflow (NIST SP 800-171 Rev. 2, POA&M, SPRS, affirmation-ready evidence).
ASE for GovCon & the DIB →Teach the engineering, not the syntax.
Engineering was always about requirements, interfaces, constraints, and verification — not typing loops. ASE lets students do that engineering and hand the implementation to governed agents: they define the problem, design the interfaces, set the review gates, and judge the evidence. Those skills transfer, which is the point — the student who can define and verify a system can define and verify an infrastructure change or a route through the backcountry. Free, self-hosted Community edition.
ASE is not a prompt-chain runner. It sits above your code-intelligence providers, your live coordination service, your graph evidence store, and your model-specific agents — and gives the engineering lead one product surface for the full lifecycle of an agent constellation working on real problems.
Vibe coding got you the speed. ASE gives you the precision to keep it.
What ASE owns
- Project & problem definition — guided, LLM-assisted intake captured as versioned definitions.
- Design elaboration — architecture, interface, constraint, and compliance plans, version-tracked.
- Compliance control matrix — mapped to your regulatory regime, with exception/approval workflows.
- Vertical packs — reusable definitions per solution domain: greenfield, feature, and legacy-parity software work; platform engineering and IaC; govcon document generation (PPP, SCG) and CMMC self-assessment; route and expedition planning. A new domain is a new pack, not new code.
- Model & harness catalogs — choose the model and the agent CLI per role; bring API models or run fully local.
- Live orchestration dashboards — claims, leases, gates, branches, work items, failures, compliance state.
- Change control — risk-scored human approval gates around merges, applies, releases, and exceptions.
- Tamper-evident audit — chain-hashed evidence and compliance reports (JSON, CSV, HTML, PDF) you can hand to auditors.
What ASE delegates
- Identity to Keycloak — secure OIDC authentication, MFA, passkeys, and role-based access control.
- Live claim arbitration to CLAiR — real-time agent coordination, transient claim leases, and gate enforcement using the Agentic Code Orchestration Protocol (ACOP).
- Security findings to CLAiR — penetration-test findings become first-class, target-scoped remediation and retest work that an ASE hardening constellation claims and closes, with retest blocked until remediation is accepted.
- Code intelligence to the Planning boundary — code parsing, symbol analysis, and dependency mapping (with Bo as the default provider).
- Durable graph evidence to CLAiR Graph powered by BogDB — storing tamper-evident, chain-hashed run records in our embeddable, in-process graph database.
- Model-specific authoring to individual agent processes — code, IaC, or prose, executed via secure harness catalogs (Codex, Claude Code, OpenCode, or local models via Ollama and LM Studio) integrated with Keycloak credentials.
Each authority boundary is a contract, not a black box — you can swap providers without rewriting your control plane.
Built to work under CMMC — inside your boundary.
ASE deploys entirely inside your network and can run on local models, so neither your source, your documents, nor your prompts have to leave your perimeter. That makes governed AI work practical for the same environments that hold CUI — whether the agents are writing code or drafting a Program Protection Plan.
When AI writes code inside a CUI-handling system, ASE governs how it’s generated and produces the provenance to show it — the source it came from, the technique that produced it, the control it maps to, and a signed attestation. That’s the seam your current secure-development evidence doesn’t yet cover.
Read the full story →Built-in vertical packs for CMMC Level 1 & 2 self-assessment (NIST SP 800-171 Rev. 2 — scope, FCI/CUI data-flow, evidence package, POA&M, SPRS, affirmation-ready evidence) and for govcon document generation (SCG, PPP) that deterministically apply your program’s designated classification markings to the generated drafts — ASE applies the markings, it doesn’t decide what’s controlled.
Beyond Ordinary is a Cyber AB Registered Practitioner Organization (RPO). ASE helps you prepare your evidence and self-attest — it does not assess, certify, or determine your compliance. You own your attestation.
What a governed run looks like
Shipped in ASE 1.0: an operator stands up a small agent constellation against a single target — a repository, a stack, a document set — with the controls and evidence you’d expect for production work. The loop is the same in every domain.
- Define the system or problem through a guided, LLM-assisted interface.
- Produce versioned problem, compliance, and constellation definitions.
- Connect to your CLAiR Keycloak realm, CLAiR coordination service, Planning provider (Bo), and CLAiR Graph (BogDB) store.
- Pick the vertical pack for the domain and launch a small agent constellation.
- Observe live claims, leases, work state, and failures in real time.
- Export an audit and compliance report for the run.
Built for self-hosting
- .NET 10
- Blazor Server / Blazor Web App for real-time interaction
- SignalR-backed live updates
- SQL-backed operational store
- CLAiR Graph / BogDB integration for graph evidence
- Keycloak OIDC with MFA and passkey support
- Run fully local — built-in harnesses for Ollama and LM Studio keep model inference inside your network
- Self-hosted first — Docker Compose for local and dev operation
From a free, self-hosted Community edition to Enterprise — the same control plane, licensed by scale.
Why self-hosted
Your source code, your infrastructure state, your controlled documents, your compliance posture, your identity authority. ASE deploys inside your network alongside the rest of your engineering stack — no agentic activity, evidence, or definitions leave your perimeter unless you choose to export them.
For regulated workloads, this is not a nice-to-have. Auditors need to see who approved what, what evidence was captured, and what the agent constellation actually did — with the same trust model you already apply to the humans doing the same work.
The same control plane, licensed by scale
Start free. Try Solo with 6 free constellation runs — a resource governor, not a countdown: no clock, no card, runs that die of infrastructure causes are on us.
| Edition | For | Price |
|---|---|---|
| Community | One operator, one project, 3 concurrent agents — free forever | Free |
| Solo |
The individual operator: unlimited projects, 10 concurrent agents, tamper-evident evidence export
Founding seat — 50 of 50 left at this price. Locked while you stay subscribed; seats never reopen.
|
|
| Team | Unlimited users and unlimited projects, basic RBAC | $1,788/year |
| Business | Unlimited users, Governance pack: change control, compliance dashboards, evidence & audit export, IdP federation | $749/month (billed annually) |
| Enterprise | Unlimited users and agents, remote workers, air-gapped deployment | Contact Us |
| + Vulnerability Fixing | Agent-lead vulnerability analysis and fixing | $699 monthly |
| + Binary Decompiler | Agent-lead binary decompilation and analysis | $399 monthly |
| + Security Documents | Agent-lead generation of security documents used by the US federal government, e.g. PPP, SCG. | $599 monthly |
Agent inference is always yours — your Claude/Codex subscriptions, API keys, or local models. ASE never meters tokens.
Elevate Your Vibe with ASE Precision.
ASE 1.0 is available to design-partner organizations. If you’re trying to operationalize agents against real work — a regulated codebase, a production platform, a controlled document set — the 30-minute walkthrough is the fastest way to see whether ASE fits.
Already approved? Sign in to download.