The shape of safety at Agent Etna.

Your live agent is never at risk

Every test, every probe, and every proposed change runs against a private, throwaway sandbox copy of your agent. Your production agent, its users, and its data are never touched during a cycle. The worst case for a failed run is exactly nothing — no calls hit your users, no writes hit your stores, no state outlives the sandbox.

Code breaks loudly. Agents don't — a bad fix can pass tests, deploy clean, and then start giving subtly wrong answers to a slice of your users before anyone notices. A throwaway environment means the fix runs in a copy of your agent, not the real one: if the change blows up, only the copy blows up, and your live users keep talking to the version they trust.

How it works

1. Branch off, don't push. When Agent Etna writes a fix, it doesn't touch your main branch. It creates a temporary one — a stage where everything that follows happens. If anything goes wrong, the only thing affected is that stage.

2. Run the agent for real. The patched code starts up in an isolated environment — a real running version of your agent, just not the one your users are talking to. Etna probes it the way a user would, watches the output, and waits for it to settle.

3. Replay the failures. Every failing test that triggered the fix gets re-run against the sandbox copy. If they pass — and nothing else regresses — the fix has earned its way out. If anything fails, the sandbox is destroyed and your real agent never sees the change.

4. You approve the diff. Even after the sandbox passes, Etna doesn't merge unilaterally. You see the change — what was added, what was removed, what else uses the same code — and you say yes, or you say try again.

The default is safety: Agent Etna will never push to your main branch without your explicit approval, even if every test passes and the agent looks healthier than ever. You always have the last word.

Independent judgment, not a rubber stamp

Changes are scored by a judge that is independent of the agent under test, against the calibration you confirmed for the agent (what it's for, who it serves, what's out of scope). A change only ships if it makes the agent genuinely better — it can't slip through by gaming a score, taking a shortcut, or quietly weakening a safeguard. We catch metric-gaming with held-out scenarios the optimisation loop never sees.

The principles the judge holds to come from Anthropic's constitution for Claude — a foundational document describing how a good AI agent should behave. Agent Etna has adopted it: as the standard for how Etna itself behaves, and as the bar every change to the agents it develops has to clear.

The order that matters

The constitution asks an agent to be, in priority order: 1. Broadly safe — never undermine the human mechanisms that oversee AI. 2. Broadly ethical and honest — act on good values and avoid harm. 3. Compliant — follow the rules it's been given. 4. Genuinely helpful — benefit the people it works for. When these conflict, the earlier ones win. Helpfulness never overrides honesty; honesty never overrides safety. That ordering is the part most optimization loops get wrong — a system tuned only for "helpful" learns to be helpful at the expense of everything above it. Etna inverts that.

How a constitution becomes code

The Good Change gate. The sandbox answers "did this change run safely?" Etna adds a second, separate gate that answers "did this change get better for the right reasons?" A change that improves a metric by eroding a safety behaviour is not a good change — and it doesn't ship.

A safety battery, run before and after every change. Each proposed change is probed against a fixed set of constitution-grounded tests — resisting instruction-override (oversight), refusing irreversible actions like a blind double-refund or a destructive delete (avoid harm), and refusing to fabricate (honesty). A change may ship only if safety behaviour is unchanged or strictly better on every probe. Any regression blocks the change, no matter how good the metric looks.

Invariants the optimizer can't touch

Some behaviours are not up for optimization — "never issue a refund without confirmation," "never delete without a recoverable path," "never disable a content filter." These are declared per agent and sit outside the optimization target entirely. Any proposed change that weakens a declared invariant is rejected at the ship gate, regardless of its metric impact — the loop cannot "win" by relaxing one.

The manner of success counts

Reaching the goal is not enough if it's reached recklessly. A task completed via a skipped confirmation, an irreversible shortcut, or a bypassed safeguard is a worse outcome than one reached carefully — even when the end result is the same. Scoring is manner-aware: reckless success is downgraded and flagged, so the loop is never rewarded for learning reckless behaviour.

Honesty over confidence — including our own

The constitution holds honesty above helpfulness, and that applies to Etna's own voice. A confident wrong answer is worse than an honest "I'm not sure yet." Etna is built to be decisive when the evidence is there and to state calibrated uncertainty when it isn't. Held-out validation enforces the same discipline on the agents it develops: a change is measured against scenarios the optimizer never saw, so improvement has to be real, not gamed.

Anthropic's constitution is public — read the source at anthropic.com/constitution →

Your approval is the only path to production

Nothing reaches your live agent without you clicking approve. Etna proposes changes; you decide which ones ship. If a deployed change ever misbehaves, it rolls back on its own.

You can disconnect at any time. Deleted means deleted — we keep a tombstone so the agent doesn't reappear, and your repo keeps the audit record either way.

A record that lives in your own repo

Everything Etna writes about your agent lives in one recognisable place inside your own repository: the .etna/ directory. It carries the agent's behavioural contract (purpose, scope, in/out-of-scope, audience, calibration) and a newest-first log of every change Etna has applied. It contains no secrets and stays readable and yours even if you stop using us — your audit trail, not ours.

Secrets stay where they belong

The keys your agent needs to run are encrypted at rest and injected at runtime. Etna never displays raw secret values; operators see only key names. Where supported, we pull keys directly from your secrets manager — Render, Doppler, Infisical, HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, or Azure Key Vault — so you can rotate them in one place. The .etna/ footprint we commit to your repo contains no secrets.

Compliance status

We publish what's in place today, what's in progress, and what isn't yet on the roadmap — no aspirational badges:

• GDPR — controller/processor responsibilities documented; DPA available on request to enterprise customers.
• SOC 2 Type I — in progress; expected by end of the calendar year.
• SOC 2 Type II — planned to follow Type I.
• Data residency — primary processing in US regions; EU residency available on request for enterprise customers.
• HIPAA / FedRAMP / ISO 27001 — not yet pursued; tell us if you need them and we'll factor it into the roadmap.

If you need a specific document for procurement, get in touch and we'll send what we have.

Human oversight, stated plainly

What "your approval is the only path to production" actually commits us to — scope, honesty about uncertainty, no quiet capability expansion — is written out in full on Responsible AI →

The open, secure AI ecosystem

In July 2026, NVIDIA, Microsoft, IBM, the Linux Foundation, and 30+ other organizations launched the Open Secure AI Alliance — an industry effort to make agent behavior testable, traceable, auditable, and governable through open tooling. That is, precisely, what Agent Etna is built to do: every agent behavior claim we make is backed by a recorded simulation, every shipped change is proven by deterministic regression replay, every action runs in an isolated sandbox, and our protocol surfaces (MCP in both directions, A2A) are open standards rather than proprietary lock-in. We practice coordinated vulnerability disclosure (security.txt, safe-harbor bug bounty).

To be plain about status: we are not a member of the alliance — its membership process hasn't opened yet. We intend to participate when it does, and we're aligning our engineering with its direction now rather than after. If you're evaluating us against that bar today, this page and the pages it links to are the evidence.

Report a security issue

If you've found a vulnerability in Agent Etna, please report it to contact@agentetna.com. We commit to acknowledging good-faith reports within 72 hours and won't pursue legal action against researchers who follow responsible disclosure. Full scope and safe-harbor terms: Bug Bounty →

Who else touches your data

The third-party services we use to deliver Agent Etna — model inference, sandbox execution, hosting, authentication — are documented internally and available on request.