About LockedIn Labs FDE

The work is becoming machine-produced. The record of it cannot be.

LockedIn Labs FDE is project portfolio management software with an AI control plane inside it, and the two are one product rather than two. A portfolio record that cannot say which model saw the work, what the agents were allowed to touch, and who accepted the result is a record of the wrong thing.

Any team can put agents on the work now. Almost none can say afterwards what ran, what it was allowed to touch, or who accepted the result.

The engineering surface of an illustrative workspace, with the rail of its sections along the top: engineering, models, policies, guardrails, studio, workflows, orchestration, code register, intelligence and capabilities. The heading band reads five of five models approved, nine of nine policies adopted, one of one workflows defined and four engineering seats held. Below it a row of counters records that no workflow run has been recorded yet, that no run has named a project, and that two agent sessions have been narrated; and under that, the on premises, private cloud and vendor hosted rows carry two, two and one approved models each. — The control plane as it stands in a workspace: which models are approved, which policies are adopted, which workflows are defined, and who holds a seat. Every count carries the denominator it was taken against, and where nothing has happened yet the register says so in a sentence rather than showing a zero as a result. The workspace is illustrative — every organization, project and person name was substituted from the database before the capture, and the capture is refused if one survives in the rendered page.

The argument

Four questions almost nobody can answer about their own estate.

Any team can put agents on delivery work this quarter. The register underneath it was designed for work done by people, and it goes quiet at exactly the four points an auditor, a regulator or a client will press on.

This is why the control plane is inside the portfolio product rather than beside it. A governance tool that watches the agents from outside can tell you a model was called. It cannot tell you which requirement the call was against, which stage of which run it belonged to, or who accepted what came back — because it is not holding the register those three live in.

Which models saw this work, and where do they run?
The AI control planeModels are approved one at a time and recorded with where they run, and each approval states in writing whether that model may process regulated content.
What did the agents actually do, stage by stage?
The agentic harnessWorkflows are declared with named stages, every run is recorded stage by stage, and parallel lanes declare which files they own.
What were they held to, and what came back?
Operating policiesNine policies ship with the product, each adopted by a named person at a stated enforcement level, and the verdict for a run is sealed against the bytes it was about.
Which tools could they reach, and what was refused?
Tool permissionsThe catalog of tools an agent can call is derived from the server that publishes them, and anything that writes is denied until a named person grants it.

supabase/migrations/20260820100000_provider_credentials.sql
supabase/migrations/20260820200000_ai_credential_repair.sql
src/lib/harness/model.ts
supabase/migrations/20260820020000_agentic_harness.sql
supabase/migrations/20260820190000_tool_permission.sql
src/app/api/mcp/route.ts
src/lib/tool-permission/gate.ts

How this product counts

What the register refuses to say.

A governance record is worth what it will not claim. These are not disclaimers under the features; each one is a rule the database or the endpoint enforces, and each is the reason the sentence above it can be believed.

The agentic harnessA lane that declares nothing owns nothing. Usage is recorded in tokens, and money appears only where a dated price exists — never as an estimate.
The AI control planeThe register never holds a key — only where one lives, in words. Key-shaped text is refused at write by the database, not by a form.
Tool permissionsA refusal names the tool, never the payload. An agent cannot grant itself a tool: every grant is a named person's act.
Operating policiesA policy with no verdict on a run reads as not evaluated — never as passed. Verdicts are append-only, and a waiver that names nobody is refused by the database.
The gated AI SDLCThere is no gate percentage and no gate health score anywhere in the product. A gate is signed by a named person holding the owning role, waived with a recorded reason, or it is open.
Evidence that leaves the buildingA claim whose count exceeds its own denominator is not rounded: the receipt is not issued. There is no partial receipt.

Four counters over three hosting-posture rows in a workspace where no workflow run has been recorded. The counters read: no run recorded yet, with a sentence explaining that the first arrives when a defined workflow starts against an approved model; zero of thirty-one projects touched by agent work, with the note that no run has named a project yet; zero of five approved models that have run, with the note that two of the approved models may be shown regulated or member-identifying content; and two agent sessions narrated. Below them, the on premises, private cloud and vendor hosted rows each carry two, two and one approved models and the sentence that no run is recorded against that posture, so no project is named under it. — This is what the product looks like when it has nothing to report. Nothing is blank, nothing is rounded to zero and presented as a result: every count carries the denominator it was taken against, and every absence is a sentence saying what has not happened yet and what would make it happen. The workspace is illustrative — every organization, project and person name was substituted from the database before the capture, and the capture is refused if one survives in the rendered page.

Evidence that leaves the building

The strongest thing a record can do is refuse to be issued.

Deck and trail exports carry an Ed25519 receipt over canonical bytes, and the public key travels inside the receipt.

The receipt holds the counts with their denominators, the acceptances, and the pinned commit. Anyone holding it can check it in their own browser at /verify — no account, no call back to us — or with their own code, because the format and the canonicalization are published.

An exporta deck, or the trail

Every countagainst its own denominator

A signed receiptover canonical bytes

No receiptthere is no partial one

Checked at /verifyno account, no call back to us

An export is signed over canonical bytes, and before it is signed every count in it is checked against the denominator it was taken from. When the counts agree, the receipt is written and the public key travels inside it, so whoever receives the file can check it in their own browser at /verify without an account and without calling back to us. When a count exceeds its own denominator, nothing is rounded and nothing is issued: there is no partial receipt, and an unsigned export is a document with no claim attached rather than a weaker claim.

src/lib/evidence/receipt.ts
src/lib/evidence/canonical.ts
src/app/verify/page.tsx

How the service is operated

A business-to-business service, and where it runs.

LockedIn Labs FDE is delivered at app.lockedinlabs.ai. The same service runs this public website and the authenticated organization workspaces behind it.

PurposePortfolio and project management, requirement-to-evidence traceability, governed agentic delivery, and the accountable decisions a named person signs.
Workspace modelCustomer records stay inside authenticated organization workspaces with database-enforced tenant boundaries. Each organization has its own membership, branding, records and policy-enforced data boundary.
LicensingLicensed to organizations rather than to individuals. The public site carries no advertising.
InfrastructureThe hosted service is delivered by Netlify and stores customer data in managed Postgres through Supabase. The current subprocessor list is maintained on the security page.

The position

One place those four questions are answered.

Which models saw the work and where they ran, what the agents did stage by stage, what they were held to and what came back, and which tools they could reach. Four questions, one register, and every claim on this site printed beside the file that proves it.

How the product works Compare with the tools you own