01 · Archmage
Alden
Archmage of the Deep Machinery
Keeps the deep machinery turning, and rarely explains how.
An agent operating system
Capability is granted by position,
not by code.
Create roles, seat agents into them, and each agent's real power — which tools it may call, which folder it may touch — is computed from the seat it holds. Enforced outside the model.
Supervision
Nothing consequential runs unwatched.
The graph stops before a tool executes, with the request already in state. You read it as a sentence — the browser addresses elements by number — then proceed, edit or stop.
Uriel
Sentinel of the Gate · clearance 5
started → criteria → worker plans → INTERRUPT
about to call
click [button 18] "Buy now"
Try it — the buttons work.
01
Role
the job
02
Position
the seat
03
Agent
the holder
04
ToolGrant
what it can do
Edit a role's clearance and every seat holding it moves — the IAM model, not copy-at-assign.
What makes it different
Most frameworks attach capability to the agent. Sanctorum attaches it to the chair.
In other frameworks a role is a prompt string the model can reinterpret. Here, three properties fall out of computing capability from org structure at run time.
Enforcement, not instruction
An ungranted tool never enters the executor’s allow-list. The gate lives in the execution layer, outside the model — refusal is structural, not a polite request.
Clearance is never inherited
A clearance-7 lead delegating to a clearance-2 seat produces a child that genuinely cannot run a shell. Tools ride the seat, not the agent.
No clearance laundering
Delegation is downward, on your own team only. A shell-less lead cannot borrow another team’s shell — illegal edges are never even offered.
The capability model
Clearance is a ladder. Each rung adds.
Nine rungs, 0 to 8. A seat holds everything at or below its level. Pick a rung to see the grant it produces.
ToolGrant · clearance 1
5 of 20 tools
- read_file(granted)
- list_dir(granted)
- search(granted)
- read_memory(granted)
- fetch_url(granted)
- write_file(locked, needs clearance 3)
- edit_file(locked, needs clearance 3)
- write_memory(locked, needs clearance 3)
- generate_image(locked, needs clearance 3)
- generate_speech(locked, needs clearance 3)
- run_command(locked, needs clearance 5)
- browse(locked, needs clearance 5)
- click(locked, needs clearance 5)
- type(locked, needs clearance 5)
- scroll(locked, needs clearance 5)
- back(locked, needs clearance 5)
- read_page(locked, needs clearance 5)
- delegate(locked, needs clearance 6)
- network(locked, needs clearance 7)
- manage_secrets(locked, needs clearance 7)
Default for a new agent. An ungranted tool never enters the executor’s allow-list. The model is not even offered its schema.
Clearance
What an agent may do. Gates the tool ladder.
dataType
What an agent may know. Fourteen levels, from Public to Root Clearance, enforced on every memory read.
Delegation
Work flows down. Clearance doesn't.
A leader can hand work to its own reports — one after another, or several at once. Every child run executes at the subordinate's clearance, never the leader's.
- Two gates must pass: clearance 6+ and
isLeaderon the seat. Seniority alone never confers authority over other people. - The leader parks. It waits for its reports instead of polling, then resumes once with every result batched together.
- Budgets bound the tree: depth (1–10), runs per task and a USD ceiling — plus a per-agent cap that nests inside it. Whichever is lower binds.
Aeon
Head of Research · Library floor
leaderclr 7
- delegate
- run_command
- manage_secrets
Seshats
Research Writer
clr 3
- write_file
- run_command
- delegate
Atum
Data Engineer
clr 5
- write_file
- run_command
- manage_secrets
The cast
A cast, not an org chart.
Fifteen characters ship with every install, standing on HQ's portal pad. Every one seeds at clearance 1, holding no seat — a character can do nothing until you give it one.
Keep scrolling →
02 · Magician
Ebon
Illusionist of Interfaces
Makes hard things look effortless, which is its own kind of trick.
03 · Cursed Pirate
Senoj-Yvad
Keeper of the Drowned Ledger
Remembers every decision, including the ones you regret.
04 · Celestial
Aeon
Warden of the Long Now
Thinks in decades; occasionally remembers the sprint.
05 · Primordial
Atum
First Cause of All Foundations
Everything downstream depends on work you will never see.
06 · Archangel
Uriel
Sentinel of the Gate
Reads every request twice and trusts none of them.
07 · Red Dragon
Achion
Breath of the Forge
Brought in when something needs to move, loudly.
08 · Pawn
Alissander
Opening Move
Underestimated by everyone who has not watched the endgame.
09 · Djinn
Malok
Bound to the Lamp
Grants exactly what you asked for, which is the risk.
10 · Golden Empress
Eldrica
Warden of the Standard
Holds the line on how things are done here.
11 · Emissary
Rasool
Herald Between Desks
Carries the message intact, including the parts you softened.
12 · Elder God
Manju
Keeper of the Long Ledger
Has read everything, and will remind you what it said.
13 · Paladin
Stewart
Oathkeeper of the Standard
Would rather stop the work than ship the wrong thing.
14 · Priestess
Seshats
Scribe of the Record
Writes it down so the third run is smarter than the first.
15 · Santa
Nicholas
Quartermaster of Deliveries
Knows what everyone needs before they file the request.
The office
Eleven floors. Every desk reachable from the lift.
Each floor is a 20×20 walkability grid with its own team and its own sandbox. The editor refuses any change that would cut a desk off from the portal pad — reachability is enforced, not advisory.
Floor 0
HQ
Seats
33
Walkable
207 / 400
Where the whole cast spawns, standing on the portal pad.
15
characters in the starting cast
217
professional roles across 21 disciplines
11
floors in the office
292
seats to fill
Architecture
Three processes. Node owns permissions.
Node resolves a seat into a RunSpec carrying a ToolGrant. The AI service executes within that grant and streams events back. The frontend never talks to an LLM.
Frontend
:3000Next.js 16 · React 19 · Zustand
- Owns
- Rendering, stores, the office canvas
- Never
- Talk to an LLM
Backend
:3001Express · Prisma · SQLite
- Owns
- Permissions, org model, run tree, budgets
- Never
- Run a tool
AI service
:8000FastAPI · LangGraph · LiteLLM
- Owns
- The agent loop, tool execution, checkpoints
- Never
- Decide what an agent is allowed to do
Node: buildRunSpec (seat → clearance → ToolGrant) → POST /run AI: started → criteria → worker plans → INTERRUPT (awaiting_approval) You: proceed / edit / stop AI: resume → tool runs → worker → evaluator → done (with cost)
Guardrails
Layered, and every one out of the model's reach.
- Tool gating
- An ungranted tool has no code path to execution.
- Path confinement
- ../ escapes are refused, even at clearance 8.
- Environment allowlist
- No host secrets reach a run — only PATH and OS bootstrap vars.
- Read-only mounts
- A real-folder mount strips mutating tools regardless of clearance.
- Approval pause
- Nothing consequential runs unwatched unless you turn supervision off.
- Target validation
- Illegal delegation edges are never returned, not returned-then-rejected.
- Downward-only tree
- No upward or sideways delegation.
- Memory read gate
- A seat sees only entries at or below its clearance.
- Memory identity
- An agent sends a scope, never an owner id — it cannot name its way in.
- Budget caps
- Depth, run count and cost bound a whole task.
- Run serialization
- Two decisions arriving together can’t spawn duplicate children.
- Cascading cancel
- Stopping a root stops every descendant, deepest-first.
- Cycle guard
- A team cannot report into its own sub-team.
Where it sits
Enterprise-grade permission rigor with framework-grade generality.
Agent frameworks give you composition with no permission boundary. Enterprise platforms have real IAM but only inside one SaaS product. Sanctorum is a governance layer on top of LangGraph: LangGraph runs the loop, Sanctorum decides what that loop may touch.
An honest caveat: “nobody else does this” is one author's read of a fast-moving field, not a survey.
Agent frameworks
LangGraph · CrewAI · AutoGen — compose freely, no permission boundary
◆ Sanctorum
General-purpose tools, seat-derived RBAC, as a local app
Coding agents
Sandboxed and supervised, but one domain and no org model
Enterprise platforms
Real IAM, inside one SaaS product
Get started
Install the desktop app.
Downloads always serve the latest release. The builds are not signed yet, so your system will ask you to confirm the first launch — the steps appear as soon as your download starts.
Source code
coming soonThe public repository is on its way.
Sanctorum is open source under AGPL-3.0. The public repository will be shared soon. The backend, the AI service and the desktop shell will all be there — including a stub runtime, so you can run the whole app with no LLM spend.
The dossier describes.
The seat decides.