Agora

Problem & users

Agora is the platform: agents plug into shared services instead of each reinventing permissions, approvals and logging. Any action an agent proposes passes an explicit permission check, and consequential ones wait for a human. The email agent is the first one running on it, drafting, sending and forwarding mail for operators who approve what matters.

Implementation

The platform layer is agent-agnostic: a Spring Boot gateway handles authentication and roles, a separate security service evaluates tool capabilities, and the React interface shows pending approvals and the audit trail for every agent. The email agent is a Python service using LangGraph for workflow state, calling the platform before each tool action.

Engineering decision

Keep authorization outside the model. Each tool call receives an allow, human-review or deny decision. Editing an approved draft triggers authorization again before execution. Gateway actions are recorded in a SHA-256 hash chain that can be checked for changes.

Evidence

The approval-queue and audit screenshots show the review workflow. The policy evaluator, agent graph and audit service provide the corresponding implementation; the security model documents its trust boundaries.

Current limitations

• Only the email agent ships today; a second independent agent has not validated the platform contract. Outlook has not been verified against a live mailbox, and the frontend has no automated test suite.
• Prompt-injection defenses mitigate known patterns; they do not eliminate the risk. There has been no formal third-party security audit. Most endpoints have no rate limiting.
• LangGraph checkpoint isolation relies on application checks rather than database row-level security. Audit writes are synchronized within one gateway instance; scaling needs database coordination. Actor anonymization reseals the chain, so verification then covers changes since that operation.

Sources