the open enterprise harness
AI agents for every employee. In your cloud, on open models.
OEH deploys open-source agent harnesses across your whole company, signed in with your identity provider and running on open-weight models inside your own AWS or GCP account. We keep it upgraded. You keep it.
A per-seat tax on every employee
Hosted AI tools price by the seat. Rolling them out to the whole company turns a pilot into a line item that grows with headcount.
Your data leaves the building
Prompts, code and documents flow through a vendor's cloud. For finance, legal and health teams, that is often where the conversation ends.
Tools that change under you
Agent tools ship weekly. Keeping a customized deployment current is a job nobody on your team signed up for.
How it works
The agent tools your people want, on infrastructure your security team already trusts.
Two harnesses
One for developers, one for everyone else
OEH Code gives engineers an agentic coding environment. OEH Worker brings the same agents to analysts, operators and support staff. Both run on the same identity and gateway plane.
Your identity
Sign in with what you already run
Google Workspace, Microsoft Entra ID or Okta. Access follows your groups, and offboarding someone in your directory cuts off their agents too.
Your cloud
Open models in your own account
Inference runs in your AWS or GCP account, on open-weight models you choose by policy. You pay your cloud provider at cost, with no markup and no seat fees.
Upgraded for you
A maintained distribution, not a one-off install
We track the upstream projects, carry your customizations forward and ship tested upgrades. You get the new capabilities without the drift.
Reference architecture
Three planes. Only one runs on the laptop.
Employees run the harness. Everything that touches identity, policy and models runs in private subnets in your account.
Employee device
Harness
- ›OEH Code for developers
- ›OEH Worker for everyone else
- ›One sign-in helper, OS keychain
- ›Managed policy: only your gateway
Your cloud account
Identity and gateway
- ›Sign-in with your identity provider
- ›Short-lived tokens, no static keys
- ›Per-team model access and budgets
- ›PII guard and tool authorization
- ›Metadata-only audit log
Your cloud account
Inference
- ›Managed endpoints in your account
- ›Or self-hosted GPU pools, no egress
- ›Open-weight models by origin policy
Works with Google Workspace, Microsoft Entra ID and Okta, on AWS or GCP. No vendor cloud sits in the path.
For the CISO
Built to pass the security review, not route around it.
- No static API keys
- Every request carries a short-lived token tied to a person in your directory.
- Metadata-only logging
- Prompt and response bodies stay off by default. Teams can opt in, under your key, with a retention cap.
- Model origin policy
- Choose which model families are allowed. A non-Chinese tier is the default for regulated and government-adjacent work.
- No egress beyond your allowlist
- Self-hosted tiers run with no outbound internet. Managed tiers stay inside your cloud account.
- Immutable admin audit
- Every policy, access and model change is recorded where your security team can read it.
- Yours to keep
- You receive the source of your build. If you ever leave us, your configuration keeps working.
Who it's for
Companies that can't send their work to someone else's cloud.
- 200 to 5,000 peopleLarge enough to need policy, small enough to move this quarter.
- Regulated or IP-sensitiveFinance, legal, health tech and software companies whose code is the product.
- Already on a modern stackGoogle Workspace, Entra ID or Okta, plus AWS or GCP.
- Past the pilot stageA few teams love AI tools. Now you need them for everyone, on your terms.
Engagements
Start with an assessment. Grow at your pace.
Briefing
A working session with your engineering and security leads on what an in-house agent platform would look like for you.
Assessment
A fixed-scope engagement: workflow map, model-origin policy, reference architecture and ROI case. Credited toward implementation.
Pilot
One team, live in your cloud on managed model endpoints, with your identity provider and policies in place.
Rollout
Company-wide deployment across both harnesses, device management, training and onboarding for non-engineers.
Managed upgrades
An ongoing retainer: tested upgrades, new models as they qualify, and support for your admins.
See what it would look like in your account.
Tell us your identity provider, your cloud and the teams you want to start with. We'll come back with a plan.
[email protected]