Qvrone is one governed harness with two divisions: Business Automation and the Software Factory. Agents plan the work, your rules decide what may run, and every action is verified and recorded. Zero unverified actions.
ask ›
door
signed entry
understand
model reads
plan
model proposes
gate
rules decide
hands
API first
check
read back
record
signed ledger
learn
recipes, memory
Every run goes door → understand → plan → gate → hands → check → record → learn. Models fill the neural steps; rules, schemas, graphs and read-backs fill the symbolic ones.
why › The model never holds the authority to act, approve or declare success.
A model's plan is compiled against a content-hashed task spec before anything runs: allowed tools, dependencies, budgets, approvals and a required verify contract.
why › A model cannot widen its own tool list or turn an unknown prerequisite into success.
Every write is read back from the system it touched and reported as confirmed, refused, blocked or unknown.
why › Unknown is never reported as done. Enforced today for approvals; rolling out to every tool.
An approval is bound to one tool, its arguments and the policy version, re-checks who you are, and works once.
why › A changed argument needs a new approval; a replay is refused.
Software is read as named elements from the accessibility tree or the page, not pixels. A gate checks each action before it runs and verifies the effect after.
why › It fails closed where pixel-clicking agents fail open, and you can write rules about it.
Your agents share your browser logins, files and a governed terminal, each on its own leased screen, with chats and memory kept private.
why › Agents work in your real tools without passwords handed to a model.
Persistent, named agents, each with its own conversations, memory and responsibilities, with progress you can watch and stop.
why › Work does not end when the chat does.
Before any model call: rule, then recipe, then cache, then a small model, then a big one, inside token, step and cost budgets.
why › A request a rule can answer spends no model tokens.
Agents propose. Your rules decide. The gate runs the action, then checks it.
A write counts only when it is read back from the system it touched. Enforced today for approvals, rolling out to every tool.
Decision tables you control allow an action, refuse it, or ask you first.
Send 3 payment reminders on WhatsApp
tool whatsapp.template.send
args { invoices: [INV-1042, INV-1047, INV-1051] }
bind sha256 7f3c…a91e (tool · args · policy · run)… waiting for the owner. Nothing has been sent.
Money, customer messages and code changes wait for you, bound to the exact action you saw.
Move tomorrow's 4 PM appointments to Friday, same time.
Two at 4 PM tomorrow: Asha and Ravi. Friday 4 PM is free for both.
This messages your customers, so your rule holds it. Approve both?
approve
Done and checked: both read back at Friday 4 PM, both customers notified.
Chat and voice agents that answer, book, remind and reschedule, in English and Indian languages.
Payments, invoices, mail, calendars and sheets, each with its rules built in.
Reminding 3 overdue invoices
Reschedule needs your approval
Next scan 02:00 · no one needs to start it
each Bubble keeps its own chats and memory · all of them pass the same gate
Persistent, named agents, each with its own responsibility, conversations and memory. Give work in a conversation and it follows through.
accessibility tree
model propose click(e14)
gate re-read tree · e14 = button “Save” in form “Receipt” ✓
gate policy: save_voucher → allow · receipt r-7c1 (one use)
hands click e14 · receipt spent
check re-read · status “Voucher saved” appeared → confirmed
API first. Where there is none, symbolic computer use reads the screen as named elements, and the gate checks every click before and after.
request › Fix: routes trust workspace_id from the body (#142)
Every request becomes a task spec with acceptance checks and a bar, fixed before a line of code is written.
Plans run in an isolated sandbox, and the change arrives as a pull request with its evidence attached.
$ task #142 · scope: src/routes
+ enforceSessionWorkspace(req)
- const ws = req.body.workspaceId
+ test: foreign workspace → 403
bar committed before code ✓
$ verify #142 · fresh checkout
typecheck ............ 0 errors
tests ................ 0 failed · 0 skipped
sabotage: drop guard → 403 test RED
restored → GREEN
VERDICT APPROVE → PR for you
A separate verifier re-runs every check from a clean checkout, and breaks each test once to prove it can fail.
02:00 scheduled run · no one started it
route audit 2 routes read workspace_id from body
osv scan 1 high · lodash 4.17.20
secret scan 1 token · .env.example:12 (value hidden)
fix PR #231 opened · waiting for your approval
Scheduled route audits, dependency scans and secret scans become findings, then a fix pull request for you.
The same path for every action, in both divisions. Nothing reaches your systems without a rule allowing it, and nothing counts as done until it has been checked.
You ask in plain words, or a teammate does. The agent turns the request into a plan of tool calls. A plan is only a proposal.
plan: [bookings.find, bookings.reschedule ×2, notify ×2]Each step is checked against your decision tables before it runs: allowed, refused, or held for you. The model never gets to overrule a rule.
rule: notify_customer → ask_ownerMoney, customer-facing messages and code changes wait for you. Your approval is bound to the exact tool, arguments and policy you saw, and works once.
approval: bound(tool, args, policy) → single useThe action runs through one governed path, then the result is read back from the real system. Confirmed, refused, blocked or unknown, and recorded either way.
verify: confirmed | refused | unknown → ledgerWork that has been verified enough times will replay as a recipe: still through the gate, without paying a model to think it through again. Two failed checks demote it. Coming.
recipe: promoted after verified runs · comingEvery integration is a connector on the same harness: signed doors, scoped credentials, default rules and a verify step for every write. Each is labelled with its real status until it is certified.
Business Tier 1 · certifying
Software Factory Tier 1 · early access
Commerce
CRM & support
Messaging & marketing
Something missing? New connectors are built on the same kit, with the same rules, approvals and verify step, and are certified as customers need them.
We don't promise an AI that never errs. We promise nothing is reported done without proof: a write is read back and reported as confirmed, refused, blocked or unknown. Enforced today for approvals, rolling out to every tool.
Each tool call is recorded with the authority and policy decision that let it run, the actor and the time, in a signed chain you can export.
Name the actions an agent may not take alone. They pause for sign-off, and the approval works once, for exactly what you saw.
Row-level security in the database fences each workspace's data, enforced by Postgres itself and not only by our code.
Connector credentials are encrypted at rest with AES-256-GCM and stored per workspace.
A connector is certified only after each of its checks (signatures, revoked tokens, missing rules, unknown results) has been sabotaged and seen to fail.
A workspace fee reserves your capacity. Beyond it you pay per outcome that was read back and confirmed, plus provider usage at cost. The model can still be wrong; you never pay for a result nobody could prove.
You pay when a result is read back and confirmed. Refused, blocked and unknown are never billed.
We price outcomes, not tokens, so every cheaper path (a rule, a recipe, a cache hit) is our incentive as much as yours.
Voice, carrier, messaging and heavy compute appear line by line at provider cost.
Per-workspace caps stop spending before it happens, not after.
1 — Workspace: reserved capacity
Self-serve
₹2,999
per workspace / month
One business, one workspace.
Team
₹9,999
per workspace / month
A team sharing compute across roles.
Enterprise
Talk to us
reserved capacity
Reserved capacity, your controls.
2 — Verified outcomes: billed only when confirmed
counts when: read back from the calendar
counts when: delivery confirmed by the channel
counts when: payment fetched, invoice marked, receipt sent
counts when: sandboxed run, checks green, PR delivered
refused · blocked · unknown → ₹0
3 — Usage, itemised at provider cost
Pilot rates, being validated with our first customers; your quote is confirmed in writing. Prices exclude GST and local taxes. INR and USD are priced separately, not converted.
Agents that plan and do real company work across your tools, under rules you set, with every action verified and recorded. The intelligence is in the agents; the trust comes from the harness around them.