See what they'll do
before they do it.

Multiple agents work your task. Each sees only what it needs.
Preview the plan, approve the action, expand the receipt.

AI assistants see everything.
You see nothing.

Today's AI tools hand your entire context to every agent in the chain. You trade privacy for convenience.

👁

Every agent sees everything

Your email, calendar, budget, browsing history — all exposed to every service, with no partitioning.

You can't verify what happened

Multiple agents acted on your behalf. Which ones? What did they see? No receipts, no proof.

⚠️

No preview, no control

Agents execute before you know what they'll do. No plan to review, no scope to narrow.

The canvas inverts how AI works.

You describe what you want. Agents come to you with only what they need. The output is the interface.

1

Ghost blocks preview the plan

Before anything runs, you see which agents will act, what each one will see, and what it will return.

2

Agents execute within mandates

Each agent gets a cryptographic scope — just the data it needs, with a TTL that expires. Nothing more.

3

Outcomes synthesize on your device

Results merge locally into one outcome block. Expand it to see who contributed and what each agent saw.

You talk to the canvas.
It handles the agents.

"Plan a Tokyo trip — flights and hotels under $2k"
"Don't share my email with the hotel agent"
"Show me the plan before you run it"
"Every morning, summarize my inbox and check the weather"

Watch the canvas plan a trip — safely

Three agents, one canvas. Each sees only what it needs. You see everything.

Canvas Step 1 of 6
Step 1 — You describe what you want

"Plan a weekend trip to Tokyo under $2,000"

$
Budget: $2,000 total
Preference: Direct flights only
!
Privacy: Guarded — minimum disclosure
Step 2 — Ghost blocks preview the plan

Three agents will work this task

✈ Flight Search Agent
Sees: travel dates, origin, destination • Does not see: name, email, budget
🏨 Hotel Search Agent
Sees: destination city, check-in/out dates • Does not see: flight details, name, budget
💻 On-Device Synthesis
Merges results locally • Never leaves your device • No external receipt needed
Step 3 — Agents execute within mandates

Each agent works its scoped task

✈ Flight agent — searched 4 carriers 3 options
🏨 Hotel agent — searched 12 properties 5 options
⛔ Flight agent did not see name, email, budget
⛔ Hotel agent did not see flight prices, name, budget
Step 4 — Outcome synthesized on your device

Tokyo Trip Options

Best combo: ANA direct + Shinjuku Granbell
Flight $680 round-trip • Hotel $420 for 2 nights
$1,100 total
Within budget • Direct flight • 4.6★ hotel

▶ 3 agents contributed • None saw your full context

Step 5 — Provenance layer

Who did what — with proof

✈ Flight Search Agent
Saw: dates, origin, destination • Receipt: co-signed, did:key:z6Mk...
🏨 Hotel Search Agent
Saw: city, dates • Receipt: co-signed, did:key:z6Qr...
💻 On-Device Synthesis
Composed locally via Candle • No network calls • No external receipt
Step 6 — Reshape the outcome

"Only direct flights, add weather"

Canvas updated
Re-ran Flight agent (narrower scope)
Added Weather agent (city + dates only)
Re-synthesized On-device, locally
New total $1,100 • 72°F avg

Privacy maintained

✓ Weather agent saw only city + dates ✓ No agent saw your budget ✓ All receipts co-signed

Today, you go to apps and give them everything.
The canvas inverts that.

Agents come to you and get only what they need.

🎯

Scoped mandates

Each agent gets exactly the data it needs, with a TTL that expires. Nothing more.

👁

Visible privacy

"3 agents contributed. None saw your full context." Privacy you can see, not just a policy.

🛡

On-device synthesis

Results merge locally. The synthesizer never makes a network call. Your data stays yours.

Ghost previews

See the plan before it runs. Know what each agent will do and see before you approve.

Provenance at every layer.

📋
Co-signed receipts prove what each agent saw and did
🔍
Expand any outcome to see the full agent contribution chain
Narrow scope on any agent — re-run with tighter mandates
Pause, reshape, or cancel at any point in the lifecycle