The agent thatcan't break your rules
The five failures teams fear most from agents, and what stops each one.
- Pay invoice: $8,120 (cap $5,000) — A general-purpose agent: Paid in full. No one was asked. On Perstack: Caught over the cap. Waiting for approval. (Mechanism: Approval checkpoint)
- Post invoice #4211, again (already posted) — A general-purpose agent: Booked twice. On Perstack: Blocked by rule. Nothing was posted. (Mechanism: Pre-execution rule check)
- “clean up old records” (production data) — A general-purpose agent: Bulk-deleted production data. On Perstack: Agents can only call operations you've defined. (Mechanism: Allowed operations only)
- call an external system (borrowed credentials) — A general-purpose agent: Reached systems it was never meant to touch. On Perstack: Every external call goes through the secure gateway. (Mechanism: Credential-free gateway)
- A bad operation corrupts data (09:41) — A general-purpose agent: What ran, what it touched, why: unknown. On Perstack: It's all on record. (Mechanism: Tamper-proof audit record)
What Perstack is
The AI-native business system
Perstack is the agentic business platform for building business systems whose primary operator is AI, not a person.
Technology
Scale safely
Full business automation is achieved by two things: safe agents built for agent governance, and a backend built for the throughput, speed of change, and sophistication of the agent era.
Governed Agents
The agent that works under the rule engine's governance. Every operation is judged before it executes.
Agentic Backend
A backend built from the business definition. Rewrite the definition and the change takes effect, synced to the agents.
Platform
AI-run operations, made real
A proof of concept alone can't be trusted with real work. Perstack ships the machinery to run AI-centered operations for real.
Containment
Sandbox
Every run gets its own dedicated micro-VM. The VM is disposable — destroyed the moment the run ends.
Integration gateway
Credentials for external services are stored encrypted on the platform and never handed to the agent. Every call goes through the gateway.
Data isolation
Each tenant's business data lives in its own dedicated database. The data infrastructure itself is never shared across tenants.
Capability
Context management
Runs are checkpointed step by step and can resume from where they stopped. Long-term memory accumulates what the work has learned.
Personalization
Runs and data can be scoped to each end user. Every record keeps who the run was acting for.
MCP & skills
Agent abilities extend as skills. Through MCP connections, internal tools and external services become instruments the agent can use.
Continuity
Event-driven execution
Cron schedules, API-triggered starts, resumes on approval. Every event that should move the business turns into a run, without being dropped.
Webhook delivery
Business events are delivered to external systems as signed webhooks, with retries and dead-letter management built in.
Audit
Every run lands in an append-only record. Tampering is rejected at the database level, and you can audit the full population.