Five safety gates between AI and production
How JuhJuh keeps agent work supervised, reviewable, and safe to ship. Every line of AI-generated code passes through five independent layers before it reaches your codebase. No shortcuts. No exceptions.
Every change walks the same path.
An agent does the work, then hands back a result. Before that result reaches your users it passes through five gates in order, then a person, and only then production. You cannot toggle a gate off.
MERGE ships only after a person says so.
Safety is architecture, not a setting.
AI writes code, and sometimes it is wrong. We do not pretend otherwise. We build for it. The honest version: an autonomous agent that ships its own work is a liability. So agents in JuhJuh do the work and hand back a result, but they never merge code or send a message on their own. Every result is verified before it ships, and a human has the last word.
Five gates sit between AI and production.
Five gates sit between what an agent produces and what reaches your users, and you cannot toggle them off.
Isolation
Every Task runs in its own sandbox, on isolated feature branches, so work cannot collide or leak across Tasks. The main branch is never touched, and a failed run discards cleanly.
The brew
After every step, JuhJuh checks the code inside a running copy of your services that mirrors production, then runs your tests and fixes what fails, before your pipeline and code review see it. A change that does not brew clean does not move. See Cauldron
Human review
A structured, file-by-file diff with syntax highlighting and AI suggestions, where a person approves, rejects, or iterates before the merge.
No autonomous merges
Agents propose; people decide. PRs land in your native git platform with structured descriptions, and your reviewers, approvals, and branch protection apply unchanged.
Organizational awareness
Roles, permissions, and audit logs mean the right people do the right things, and you can see who did what. Your CI/CD pipeline must pass before any PR can merge.
Three-layer sandbox. Zero loopholes.
Every AI execution runs in an isolated sandbox enforcing three independent restriction layers: tool-level blocking, path-level blocking, and anti-fabrication rules. Each layer operates independently. Bypassing one does not weaken the others. Enforced automatically in every sandbox, with no configuration required.
- Tool-level blocking. Six dangerous tool categories are completely disabled: shell access, web browsing, web search, notebook editing, computer control, and sub-agent spawning.
- Path-level blocking. Settings, configuration, credentials, and environment files are off-limits. Agents cannot read or modify protected paths.
- Anti-fabrication rules. Agents cannot invent tool outputs or fake execution results. Every tool result must originate from an actual execution.
Three independent layers
Tool-level, path-level, and anti-fabrication. Three restriction layers, enforced automatically, with no overlap to exploit.
Sandboxed tool execution
Agents run tools in isolated sandboxes with restricted permissions. No direct access to host systems, and file access scoped to project boundaries.
The controls a serious organization expects.
The controls a serious organization expects, with the speed a modern team needs. Defense-in-depth across authentication, access control, and operational security, so the platform ships the controls auditors ask for and the access model the work demands.
Role-based access control
Four permission levels (Owner, Admin, Member, Viewer) scoped to organizations and projects. You control who configures, who executes, and who approves.
Full audit trail
Every action logged: who initiated it, what changed, when it happened, and where. A full paper trail for compliance teams and post-incident review.
Network limits, when self-hosted
Access to a self-hosted installation can be limited to the office and network addresses you approve, with proxy-aware trust rules.
Rate limiting
Sliding-window rate limiting on sensitive endpoints. Stops abuse without affecting normal development workflows.
Environment sanitization
AI agents receive only approved environment variables. Secrets, tokens, and credentials never reach AI execution contexts.
Your own sign-in
Single sign-on through SAML or OIDC, so people use the accounts they already have, and SCIM opens and closes accounts as your identity provider adds and removes people. Invitations carry their role and expire.
Encrypted vault with snapshot rollback.
Secrets encrypted at rest. Auto-discovery scans your configuration for environment variables. Snapshot every change for rollback and diff comparison. Atomic deployment to infrastructure.
Encryption at rest
Secrets encrypted before storage, decrypted only at deploy time. Never stored in plaintext.
Snapshot rollback
Every vault change creates a snapshot. Compare any two versions and restore with one click.
Auto-discovery
Scans configuration files to find environment variables automatically. No manual inventory required.
Atomic deploy
Secrets deployed atomically to infrastructure. Never partially applied. All or nothing.
Every organization runs on its own subdomain.
Each organization gets a dedicated subdomain with isolated sessions, isolated real-time channels, and cross-subdomain cookie protection. Reserved slug protection prevents impersonation.
Dedicated subdomains
Each organization at its own address with fully isolated sessions. No cross-org data leakage.
Real-time isolation
Live update channels scoped per organization. No organization receives another's real-time data.
Reserved slug protection
System slugs blocked to prevent impersonation attempts. Protected names cannot be claimed.
Autonomous agents. Supervised execution.
AI agents execute with the same safety gates as the pipeline. Every agent action logged. Tool access restricted. No unsupervised writes to your codebase.
Sandboxed tool execution
Agents run tools in isolated sandboxes with restricted permissions. No direct access to host systems.
Full audit trail
Every agent action, tool call, and decision logged with timestamps. Complete accountability.
Tool access controls
Dangerous tools blocked. File access scoped to project boundaries. No lateral movement.
Anti-hallucination safeguards
Agents cannot fabricate tool outputs or invent execution results. Every output traced to a real execution.
On our service, or inside your own boundary.
Most teams start on JuhJuh's hosted service. There is nothing to install, your teams are working within days, and we run, update and support it. A team that needs more control, or must keep sensitive data inside, self-hosts JuhJuh instead.
Hosted by JuhJuh
Sign in and connect your tools. We keep the service running, updated and supported, so your people spend their time on their own work.
Your organization gets a workspace of its own, and each organization sees only its own data. When an AI agent works, the prompts and files it needs go only to the AI model companies you allow, only to do the work, inside the regions you declare.
Self-hosted, inside your boundary
In your own cloud account (AWS, Google Cloud, Microsoft Azure or DigitalOcean) or on your own premises, connected or air-gapped, with open-weight models from the Mistral, DeepSeek, GLM and Kimi families running inside. Our engineers install it and tune it to your compliance obligations.
Your sensitive information, trade secrets and know-how never leave your boundary unless you connect an outside service or chat app, approve a website for your AI agents or approve sending them out. While your AI agents run only on your own models, no AI company receives them or trains a model on them.
Start hosted and move when you're ready: our engineers move your workspace across. Some companies run both, the hosted service for most teams and a self-hosted installation for the systems that must stay inside, and each installation is kept separate.
JuhJuh does not use your code to train AI models.
JuhJuh does not use your code, prompts or execution outputs to train AI models, and our Data Processing Agreement says so. Your code, designs and know-how belong to you, hosted or self-hosted.
No training by JuhJuh
We never train a model on your code or prompts. On the hosted service, you choose which AI model companies may receive work at all.
GDPR-ready
Data handling designed for GDPR, with a full DPA available for enterprise customers.
Download the DPA
Data Processing Agreement available for download and review.
See how the gates fit the rest of the platform.
See pricing
The five safety gates are included on every plan.
OpenAI agents
Specialist agents that run under supervised execution.
OpenDeployments
Encrypted vault and atomic deploys to infrastructure.
OpenRead our DPA
Full privacy policy, terms, and data processing agreement.
OpenSee all features
Every capability, including the full Protect category.
OpenFrom idea to pull request.
Five safety gates. Three-layer sandbox. Encrypted vault. Hosted by us or inside your own boundary.
