blocked, not warned
Great in a sandbox.
Dangerous on a live system.
Keel is a harness for running coding agents against live, high-stakes systems — the discipline senior engineers apply automatically, packaged as configuration the agent cannot ignore: read-only first, every write verified by read-back, everything attributed, everything logged.
On a live system, the failure modes change.
Point an agent at a production instance — a CRM, an ERP, an ITSM platform, a billing system, a data warehouse — and its mistakes stop being cheap.
The silent no-op
The tool returns 200 and the change looks landed. It didn't — or it hit the wrong environment, or wrote under the wrong identity. Nobody notices until a user does.
The repeated burn
The agent re-makes a mistake the team already made — and painfully solved — three weeks ago. It has no memory of having paid for it.
The YOLO'd irreversible
An action a human should have eyeballed, executed on confidence. On a live system there is no undo, only remediation.
The missing trail
No audit trail. Nobody can say what changed, when, by whom — or how to back it out. Every question becomes archaeology.
None of this is the model being dumb.
It's the absence of a harness — the discipline senior engineers apply automatically and agents don't have unless you give it to them. Keel is that discipline, given.
The discipline, packaged.
Keel is Claude Code configuration, forged doing real, paid enterprise platform work — not in a demo. Four load-bearing parts. None optional.
Standing orders, always loaded
The live system is the source of truth. Read-only first. Changes go through a controlled unit. Verify every write by read-back. Attribute everything; log everything. And when a write is one a human should eyeball, the agent doesn't take it — it hands over exact steps instead. Not advice the model can skim past: the doctrine every session starts under.
Expensive mistakes, made impossible
Policy-as-code hooks intercept every action before the tool runs. Unattributed writes are refused. Edits to generated files are refused. Pushes to protected branches are refused. Blocked, not warned — the difference between a guideline and a guardrail is that one of them holds when the agent is confident and wrong.
Every burn, paid for once
When the platform bites, the lesson becomes one crisp, agent-readable fact — indexed, auto-loaded, and standing between every future session and the same mistake. 116 hard-won platform lessons banked so far, each one an incident that doesn't repeat.
An audit trail that answers the question
Every action attributed, timestamped, and appended; every change closed out and signed. When someone asks what changed, when, by whom, and how to undo it, the answer is a file — 8,784 lines of it on the record that forged this harness — not a meeting.
One harness. Swappable knowledge.
Keel is domain-agnostic — the scaffolding knows nothing about any specific platform. What it knows about yours comes from a pack: a swappable bundle of memories and guardrails for one system — ServiceNow, Salesforce, SAP, Workday, Epic. The harness enforces the discipline; the pack knows where the platform bites.
keel/ the harness — doctrine · guardrails · memory · change loop
├─ packs/servicenow/ pack #1 — platform walls + domain guardrails · reference implementation
├─ packs/salesforce/ (next)
└─ packs/_pack-template/ start yours here
Forged on paid work, not a demo.
Keel was extracted from a real enterprise engagement with money on the line. The figures below are that engagement's verified record — not projections. Nothing here is invented.
Real figures from the engagement Keel was extracted from. Counted, not estimated.
What early access actually is.
Keel today is an extracted skeleton: the doctrine, the hooks, the memory system, and the change loop — proven on one real, paid enterprise engagement, with the client specifics stripped. Pack #1 (ServiceNow) is the reference implementation being ported now. There are no testimonials, no customer logos, and no pricing page, because inventing them would break the one rule the whole thing runs on.
Bring the live system you'd never point an agent at.
Early access means the harness as it stands — doctrine, guardrails, memory, change loop — and a direct line to the person who forged it. Tell me the platform you'd run it against; that's the next pack.