Solution · Agencies
Agents for your clients, with a trail you can hand over
Deploy governed agents for clients — per-client sub-user keys, approval workflows, and a signed audit trail you can hand over with the invoice.
monopea lets an agency deploy governed agents for clients: each client operates under its own sub-user key, mutation-capable tool calls become pending proposals until someone approves them, and every proposal, decision, and dispatch is logged against Ed25519-signed audit checkpoints — a trail you can hand to the client.
You are selling AI-driven work to people who will eventually ask two questions: "what exactly did the agent do on our account?" and "who let it?" An agency that answers with screenshots loses the account; an agency that answers with a signed log keeps it. Governance is not overhead here — it is the deliverable.
Why raw autonomy is an agency-killing risk
When you run agents on a client’s behalf, every failure is a reputational one you absorb: the outreach email that went to the wrong list, the record update nobody sanctioned, the credential that leaked from a config file. The 2026 OpenClaw incidents — an RCE CVE, tens of thousands of exposed instances, malicious marketplace skills — were mostly individual operators’ problems; for an agency the same failure is multiplied across a client roster and a contract.
Client work also needs boundaries that ad-hoc setups do not have: this client’s work must not bleed into that client’s context, this client’s credentials must not be readable by anyone — including your own staff and the model — and each client’s risk tolerance needs its own policy, not a shared default.
- Per-client sub-user keys (customer_live_) keep each client’s access separately scoped and revocable
- Client credentials go into a write-only vault — stored once, never readable again by anyone
- Tool policies are granted per tool and per agent, so each client gets its own risk posture
Running client work through the gate
The delivery loop is concrete: the agent plans a client’s campaign or research brief, drafts the outreach and documents, and files each outward step as a pending proposal; you (or the client, on their own key) review and approve; only then is it dispatched, and the dispatch is logged. Scheduled runs keep retained accounts moving — weekly research digests, pipeline hygiene, drafted follow-ups — without an account manager re-prompting anything. Whatever tools the client already uses connect through MCP; unknown tools fail closed until you decide they are in scope.
The audit trail is what turns this from tooling into a service you can invoice: every proposal, approval, rejection, and dispatch on the account is logged, checkpointed with Ed25519 signatures, and attributable to a key. When the client asks what the agent did in March, you hand over the record. And with the EU AI Act’s Article 14 human-oversight obligations enforceable since August 2026, "our agents propose, a human approves, everything is signed" is a sentence your clients increasingly need to be able to say — the gate lets them say it truthfully.
Why it matters
The audit trail is the deliverable
Every action on a client account is logged and signed. "What did the agent do, and who approved it?" is a report, not a reconstruction.
Clients stay isolated
Per-client sub-user keys, per-tool policies, and a write-only vault for their credentials — one client’s work and secrets never bleed into another’s.
Retainers that run themselves
Scheduled runs carry the recurring work — digests, drafts, hygiene — and file outward steps as proposals, so delivery continues between your check-ins.
FAQ
Agencies, in short
- Can I give each client their own access?
- Yes. Alongside your tenant key, per-client sub-user keys (customer_live_) scope a client to their own access, separately revocable. A client can hold their own approval rights, or you can review on their behalf — the log attributes either way.
- What do I show a client who asks what the agent did?
- The audit trail: every proposal, approval, rejection, and dispatch on their account, logged and checkpointed with Ed25519 signatures. It is a record you can hand over, not a screenshot deck.
- How do I keep an agent from doing something a client would hate?
- The gate is default-deny: mutation-capable tool calls wait as pending proposals until approved, and unknown tools fail closed. You grant per-tool autonomy explicitly, per client, so each account runs at its own risk tolerance.
- Do my clients’ credentials pass through the model?
- No. Credentials are stored in a write-only vault and referenced as {{secret:NAME}} placeholders; the value is substituted only at dispatch and scrubbed from results before they re-enter context. Neither the model nor your staff can read a stored secret back.
Keep exploring
Indie founders
Autonomy for your ops — inbox, invoices, outreach, research — behind an approval gate, without running an exposed agent instance yourself.
Privacy-first operators
Data minimization as the default state: Zurich storage, EU processing, Swiss-hosted open-weight models, incognito turns, and write-only secrets.