The product

One controlled environment for client AI work.

An AI worker is an agent operating with the context, tools, permissions and working environment needed to complete real work. Outloop is not one feature: it is eight layers that have to hold together for that worker to finish a real client task — and the layer that keeps them holding.

Last updated:

In short

Outloop is the access and control layer for AI agents doing client work.

It runs on a computer your company controls. Agents start from approved client context, use approved API access without ever seeing the credential, stay bound to the correct client account, move real files, and leave a redacted audit trail. Any lesson learned becomes a change only after a person approves it.

The Outloop assistant working at a desk

Reuse approved API access across the runtimes your team already uses

One approved access layer for Cowork-style sandboxes, Claude Code, Codex, Hermes, and OpenClaw — without rebuilding setup for every platform. Add or change an approved runtime; context and approved access stay attached to the client workspace.

One credential. The right workspace. Any approved agent runtime. secret_exposed:false

Independent tools. Names and logos belong to their respective owners; Outloop is not affiliated with or endorsed by these projects.

One request, from ask to audit.

Layer 04 is where most of the confusion lives, so here it is in full.

One request, from ask to audit

One request, from ask to audit Ollie, the AI worker, submits a task. Inside the Outloop environment the request passes a policy and tenant check, reaches the local broker, and returns a redacted result — every step recorded in the audit log. A wrong-client request stops at the policy check before any credential is used, and is still audited. 01 Ollie · the AI worker Update Google Ads campaign submitted by an approved person The Outloop environment 02 Policy & tenant check project, identity, policy TENANT_MISMATCH 03 Local broker Credential used on the wire 04 Redacted result no raw value returned 05 Audit log Every attempt recorded — approved and denied alike. secret_exposed: false One request, from ask to audit 01 Ollie · the AI worker Update Google Ads campaign submitted by an approved person The Outloop environment 02 Policy & tenant check project, identity, policy TENANT_MISMATCH 03 Local broker Credential used on the wire 04 Redacted result no raw value returned 05 Audit log Approved and denied alike. secret_exposed: false
  1. Ollie, the AI worker, submits a task: Update Google Ads campaign.
  2. Inside the Outloop environment, the request meets a policy and tenant check — project, identity and runtime policy.
  3. On approval it reaches the local broker, where the credential is used on the wire. The agent never receives its value.
  4. A redacted result is returned. No raw value goes back to the agent.
  5. Every attempt is written to the audit log — approved and denied alike. secret_exposed: false.
  6. A wrong-client request stops at the policy check with TENANT_MISMATCH, before the broker and before any credential is used. It is still audited.

Ollie does the work. Outloop controls how the work happens.

The worker stands outside the boundary. Every step that decides, performs, redacts or records the work happens inside it — including the one that stops a wrong-client request before a credential is touched.

The eight layers, and what each one is for.

Each layer carries its own evidence label. Where something is built but not yet broadly proven, it says so. Two things are deliberately not on this list — the model and the agent runtime. Both are yours to choose and to change. The eight layers are what stays.

  1. 01

    A company-controlled computer

    shipped

    Outloop runs on a Mac your company controls — a dedicated machine inside the company is the preferred foundation, with a remote machine as a quick start or backup. Outloop does not supply or host that machine.

    Local-first describes the trust boundary, not where the desk is. Execution authority stays on your side of it.

    Cloud agents vs dedicated machines
  2. 02

    Client context

    proven in product

    Each client workspace holds its own approved knowledge — brand and tone guidance, approved references, communication rules, constraints on what may be claimed. The agent retrieves it before it generates anything.

    Otherwise every run starts blank and a person re-explains the client from scratch. Context is knowledge only; it never grants API permission.

    Context and governed learning
  3. 03

    Client identity

    shipped

    A workspace is derived from the real project folder and maps to exactly one client. A new workspace starts with no grants and no API access.

    The agent has to know who it is working for before anything else is safe.

    Wrong-client access
  4. 04

    Approved access

    proven in product

    The agent requests an approved action, not a secret. Policy checks tenant, project, service and host; the local broker uses the credential host-side and returns a redacted result.

    The agent gets the capability of a credential without ever receiving its value.

    Agent runtime access
  5. 05

    Account and resource binding

    verified for the tested model

    One agency credential can legitimately reach many client accounts. A workspace is pinned to the specific account, property or folder it may use, and a request naming another is denied before any backend call.

    A Google Ads manager login can reach every account under it. Pinning is what makes one credential safe across many clients.

    Workspace-to-resource binding
  6. 06

    Files and media

    proven within tested scope

    Agents work with real client files through approved paths — Drive and Shared Drives, approved local media roots — including large media transfers to approved business platforms.

    Agents that can write a caption but not move the video hand the work back to a human at the last step.

    Real client file work
  7. 07

    Audit

    shipped

    Allowed and denied attempts are both written to a redacted local audit — decision, tenant, service — with no raw values.

    You can answer what ran, for which client, with which access, without storing a secret to do it.

    Security model
  8. 08

    Governed learning

    proven in product

    After a run the agent can propose a lesson as a structured receipt. A person approves, edits, rejects or defers it. Only an approved lesson becomes a new Context revision, and revisions are versioned and restorable.

    Improvement without a review step is just drift you cannot audit. Nothing updates itself.

    How learning is reviewed

What Outloop is not.

  • The AI worker itself — Outloop supplies neither the model nor the agent runtime nor the computer. You choose those.
  • A vault or a secrets manager — Outloop sits above the one you already use.
  • A cloud agent host — the agent runs on your machine, not ours.
  • An MCP marketplace or an MCP manager.
  • A campaign automation or reporting tool — the agent does the work; Outloop controls the access.
  • A replacement for 1Password, Infisical, Doppler or macOS Keychain.

What agents actually do with it: the AI agent capability catalog · ready-to-download agent Skills.
More on the boundaries: Outloop is not a vault · credential broker vs MCP authentication · the long-term thesis.

Keep your vault. Control runtime access.

1Password
macOS Keychain
Infisical
Doppler

Outloop works above Keychain, 1Password, Infisical, Doppler, and other secure backends. It does not replace your vault. It controls which workspace and runtime can use approved access.

  • No API keys uploaded to cloud.
  • No raw key returned to the agent.
  • No .env files required.
  • Wrong-client access is blocked before credential use.

See it on one of your own client workflows.

Start the guided trial and run your first approved access proof locally — or send us one workflow and we will show you where the access breaks.

Start 14-day trial Request a Workflow Review
Questions

The Outloop product — FAQ

Ready to get out of the API loop?

Serve more clients with AI workers — and reuse what works.

Put AI workers to work across real client operations — and turn approved learning into reusable agency know-how.

Start 14-day trial Request a Workflow Review

For agencies and operators managing 5 to 100 client workspaces.