Skip to content
ChronosALUXION Chronos

Enterprise governance

Chronos is built so your organization stays in control of how AI agents work on your code. The enterprise panel is the signed source of truth for that control: administrators configure policy centrally, and it is applied automatically to every session — you get the productivity of autonomous agents without giving up oversight.

What the panel governs

Section titled “What the panel governs”
  • Connected tools (MCP catalog). Agents can use only the MCP servers your organization has authorized. Nothing outside the signed catalog is reachable, and it cannot be added locally. See Connected tools.
  • Governed context. Company prompts, standards, skills and conventions are materialized into every session’s managed context at creation — highest precedence, never committed to any repo.
  • Capability packs. The built-in packs — Kairos (method skills), Tempo (output optimizer) and Pulse (reuse-first guardrail) — plus any others the organization adds, enabled or disabled per scope from the panel.
  • Credentials. Upstream secrets live in the panel and are minted to the local broker on demand. Agents only ever see 127.0.0.1 — never the secret, never the real endpoint.
  • Identity and roles. The panel is the organization’s identity source. Roles decide who can certify work and who can merge to the main branch.
  • What gets recorded. Every authorization, credential mint and cascade change flows into an append-only audit trail, complementing the local session audit. See Audit & traceability.

Trust model: signed, verified before trust

Section titled “Trust model: signed, verified before trust”

Policy is not just downloaded — it is verified before it is trusted, so what runs on a developer’s machine is genuinely what the organization approved.

  • The panel signs every bundle (catalog, context, packs) with an Ed25519 private key it never ships to clients.
  • Each daemon holds only the public key, pinned when the device signs in with chronos login. The daemon can verify a bundle; it can never forge one.
  • An unsigned bundle, an invalid signature or an unknown key id is rejected, not silently degraded. A tampered context bundle materializes nothing, and the failure is audited.
  • Key rotation is safe for live sessions: the panel retains previous public keys in its trusted-key set, so rotating the active signing key does not break daemons that pinned an earlier key.

Global → team cascade

Section titled “Global → team cascade”

Every governed entry — MCP, context entry, capability pack — is scoped global or team. Organization-wide defaults apply everywhere; team-scoped entries apply on top, and a team-scoped entry wins over a global one with the same id.

The cascade is resolved twice, by design:

  1. Panel-side — bundles are filtered by the requesting identity and its teams.
  2. Daemon-side — the daemon re-resolves the cascade over the signed payload before materializing anything.

This defense in depth means neither side has to trust the other’s filtering.

Why it matters

Section titled “Why it matters”
  • Consistency — every developer works under the same approved tools, context and rules, automatically.
  • Safety — agents cannot reach unapproved tools or data, and credentials are never exposed to them.
  • Accountability — a complete record of what was done, by whom, and what it passed.

For administrators

Section titled “For administrators”

Governance is configured centrally in the panel dashboard. If you need a new tool, capability or permission, request it from your Chronos administrator.