Build the apps your team needs, control what they can access

Give your team the freedom to build the apps they need while you retain full control over exactly what they can and can't do.

Leave your email and we'll get in touch.

How it works

What happens inside an app, and what GraphHarness changes

A narrated walkthrough, about four minutes long. It follows one request through an ordinary web app, shows what changes when AI agents write the code, and then rebuilds the same app with GraphHarness, where every piece of code sits behind its own door.

Open the interactive version, which lets you jump between its seven chapters.

The sections below go through the same ideas with a real example: an operations lead's refunds app connected to Xero.

Without GraphHarness

How building apps with agents works today

A diagram comparing what an ops lead is allowed to do with everything an API key can do in Xero

Keys and code are editable by any agent

An app built with Claude connects to Xero, Stripe or your database with a key that can usually do far more than the person who built it is allowed to do.

That key sits inside the app's code. Anyone who can edit the code, or ask an agent to, can change what the app does with it.

A part-time support colleague opens the shared refunds app and can see every customer balance and a payroll journal

Everyone who opens it gets the same access

When the app is shared, a colleague in support sees every customer balance and the payroll journal, because the app uses the key's access instead of theirs.

With GraphHarness

The same app, built on GraphHarness

A Claude conversation building a refunds workflow, with each step labeled by the permission it needs
1

Build in Claude Code or Codex, as you do now

GraphHarness is a skill you add to Claude Code or Codex. You describe the tool you need. Each step of what gets built states the access it needs.

Xero and customer database services with most operations locked, and a permission request the builder can only partly grant
2

People can only grant access they already have

Xero, Stripe and your database are connected once, by whoever owns them. When an app asks for access, the person setting it up can approve only what their own role allows.

Maya's agent can edit her refunds app, but the Xero service code that holds the key is owned by Finance and closed to her agent
3

An agent can only change the code its user owns

Tighter permissions on a key or an MCP server limit what that connection can do. They don't stop someone editing the code around it to use the connection differently.

In GraphHarness, the code that connects to Xero or your database belongs to whoever owns that system. Maya's agent can use the Xero service, but it can only change Maya's own app.

A second user runs the app and gets only the overlap of his access and the app's grant, through a short-lived token
4

Each person sees their own data

When a colleague opens the app, it runs with their permissions. The app receives a short-lived pass for that one job. The keys stay inside GraphHarness.

An app update asking for a new permission waits for the finance director's approval
5

New access waits for approval

If an update asks for more access, it goes to the person responsible for that data before it goes live. Every run is logged with who ran it, which version, and what data it used.

Every team can build the software it needs

Operations, finance, sales and HR can each build tools for their own work, whenever they need them. The company sets what each tool can reach, and GraphHarness enforces it. A mistake in one app can't expose data or take actions that its users aren't allowed to.

That means nobody has to review every line an agent writes to keep the business safe.

Six internal tools from different teams, each with a scoped key, running inside GraphHarness

Get in touch

Tell us about your company and what your team is building. We'll reply by email.