Every tool. Every worker. One roof — with a provable record

The pitch everyone makes — and the part they leave out

“Connect all your tools and let AI run them” is the promise of every agent product now: point it at your SAP, your CRM, your Drive, your GitHub, and watch it work. It's a good promise. The part that's missing almost everywhere is control — once a tool is wired in, the agent usually calls it however it likes, and your record of what happened is a chat log you have to trust. PAI keeps the reach and adds the thing that was missing: a governance gate that every tool call has to pass, and a signed record you can verify instead of trust.

Connect — paste a token, or point at any MCP tool server

There are two doors in. The first is live today: own-token integrations. An admin pastes the org's Slack, Gmail, GitHub and coding tokens once; they live in the pod's vault and reach every employee's Pie, scoped per person, with every use recorded. The people using them never hold them, and the tokens never reach our control plane. The second door is any MCP tool server — the open Model Context Protocol standard — so you can bring your databases, your SaaS, community tools, or a server you built. That connector registry ships inside the stack and switches on during setup. One place to connect everything; the keys never leave your pod.

Govern — nothing acts un-gated

This is the moat. When a tool is connected, PAI doesn't hand the workforce a blank cheque — it hands it a governed action. Every tool is classified by risk. Its first use asks you. Risky classes park for your approval before they run. Every call is written to an Ed25519-signed, hash-chained audit with its parameters hashed — the same Driver Record that already covers everything else your workforce does. And if a connected server quietly changes a tool's shape, the schema hash changes, the tool loses its approval, and it has to earn your yes again. The gate travels with the tool, so “connect everything” never means “trust everything.”

Your desktop becomes a governed tool

Desktop Reach extends the same idea to your own computer. Run any MCP tool server on your machine — files, a shell, a legacy app — and the pod reaches out to it as a connector. Nothing reaches in; the pod calls out over a connection you allow. Because host tools are higher-risk, non-read actions default to a per-call approval, they wear a “runs on your computer” badge, and an org policy can switch desktop connectors off across a whole fleet. The legacy desktop app that was never scriptable finally is — with an approval on every action.

See — one screen for everything that ran

Because every tool call lands on the same chain, you get one honest view of the whole surface: what ran, what it cost, who approved it, and which tool did it. The budgets apply to tool-driven work the same as everything else; the kill switch stops it all in one tap; and an auditor — or you, a year later — can verify the record offline with no access to your systems. That's the difference between an agent that can touch your tools and a workforce you can prove touched them correctly.

Keys at cost, tools under your leash, no lock-in

We don't resell tokens or mark up tool access. Your models run on your own keys across 35+ providers (or local models for the private work); your connectors live in your pod's vault; and if you ever leave, the connectors, the memory and the record stay with you. The connecting is the easy part everyone offers. The governed record of what got connected, who approved it, and what it did — that's the part you own.