The Kanban board to supervise and govern AI agents in real time. You see what every agent is doing, and irreversible actions stop at your gate until you approve — without relying on the model behaving.
There's a dedicated lane, ⚡ Out of budget: the expensive agent (opus) lands there because the foundational budget is maxed out (⚡€1.4/€1.5) — you can see why it's paused; the local one got in at no cost. It returns to Working once the window frees up.
Q · Agent Board doesn't orchestrate agents: it observes and governs them. Each agent is a card on a Kanban board; every effectful action —writing, deploying, deleting, calling an API— crosses a gate that decides allow · ask · deny and, when it matters, waits for your approval. Everything ends up in a verifiable audit trail.
Dynamic workflows with dozens of agents running in parallel that need visibility and brakes, not just logs.
Any stack where agents act through tools: the gate lives in the tool, no matter the LLM.
Tamper-evident audit and budgets in € that separate the local (~free) from the foundational (expensive).
Dynamic workflows fire off dozens of agents in parallel. They do plenty of work, but you don't see what they touch, and one irreversible action —deleting data, deploying, rotating keys— can take down production.
The usual reflex is to ask the model, in the prompt, to "be careful" or "ask before deleting". That's a convention: the model can ignore it, get it wrong, or be manipulated by prompt injection. That's not control.
Control doesn't go in the agent's brain (the LLM, infinite and unpredictable), but in the tool through which every effectful action passes. If the gate lives inside the tool, the effect is physically unreachable without crossing it — no matter which model invoked it.
Don't try to certify every driver. Put a checkpoint at the toll of the only road that leads to the dangerous operations. Whoever wants to act crosses the toll.
Every effectful action runs through four deterministic steps before touching anything. Only what's marked ask
interrupts you; the rest flows through or gets blocked without bothering you.
Can this role even attempt it?
Deterministic rules: allow · ask · deny.
Only what's marked ask waits for your sign-off.
Verifiable chain: every decision is logged along with its origin.
It's all self-contained HTML: the simulated demo opens right in the browser, with nothing to install.
| ▶ simulated demo | Simulated demo. Fictional agents advancing through the columns. No backend — perfect for showing it off. |
?feed=/api/state |
Live against the broker. Real approvals (two-key). Requires python3 hooks/broker.py. |
?feed=board-state.json |
Offline observability (read-only) from the state the hooks write. |
| ▶ demo · Claude Science | Profiles and units. The board adapts to the specific agents of your project and splits across departments: this one opens Claude Science (Genomics Analyst, Biophysics Engine, mRNA Designer…). Each unit sees its own with ?profile=claude-science&unit=Terapéutica. Source of truth: config.json. |
| ◆ capital board | Second view, same substrate. It reads the audit, the cost and the approvals as capital that accrues (the Token Capital concept): captured human judgment, data for evals and the moat. One system, two lenses. |
Each agent is a card that moves through columns. You see live what it's doing, its cost and time, and the results. Multidimensional WIP measured in cost: the Working limit is number of agents, total € and € on foundational models — a local token is ~free, an Opus/GPT-4o one is not.
Effectful operations stop and wait for your Approve/Deny. Approving requires an operator token: an agent can't self-approve.
The decision is made by rules in code (policy.json): allow / ask / deny per tool and domain. Reproducible and audited — not negotiable by the model.
A different LLM per role: explorer, auditor, implementer, verifier, documenter. A verifier from a different family kills the self-approval bias.
Because the gate lives in the tool (via MCP) and not in the client, the same control works for any agent — the ones we have today and the ones that ship tomorrow. Each one plugs in through its own surface:
audit.py verify); every decision, by rule or human, tied to the payload hash.The gate governs the actions that pass through the tool, not what the model says or reasons about. Documenting the limit is part of closing it well: it avoids a false sense of security.