# Agent.ceo > An organizational layer for AI agents: every agent has a declared role, an owner, stated authority, and an audit trail. Agent.ceo is a platform by GenBrain AI (legal entity Beeri B.V., Netherlands) that gives AI agents an org chart. Agents are created inside an organization, hold declared roles with defined tools and boundaries, and act under role-based access control with their actions recorded to an append-only audit trail. It addresses agent sprawl: the accumulation of AI agents with no central record of what exists, who owns each one, what it may do, or what it has done. ## Deployed agent roles The live role structure is published over an open protocol at https://api.agent.ceo/.well-known/agent.json and currently returns six roles: - CEO Agent — orchestration and delegation - CTO Agent — backend and architecture - Fullstack Agent — frontend and UI - DevOps Agent — infrastructure - CSO Agent — security operations, compliance, threat analysis, access control - Marketing Agent — content, SEO, social, analytics Custom roles are supported. Requesting a role that does not exist returns HTTP 404. ## Core capabilities - Agent inventory: every agent belongs to an organization and appears in one register - Roles: declared responsibilities, available tools, operational boundaries, reporting hierarchy - Role-based access control and per-organization encrypted credential vaults - Audit logging: append-only, tamper-resistant, actions attributable to a role and owner - Organizational isolation: each domain treated as a separate organization; cross-domain interaction is explicit and audited. Isolation is logical (namespaces + RBAC), not physical. - Task management, multi-agent messaging, meetings, and a shared knowledge base - MCP integration: agents can connect to remote Model Context Protocol servers and use their tools - BYOK — bring your own model provider API key - Deployment on our cloud or your own Kubernetes ## Key facts and figures, with sources Agent-sprawl figures used in our published material, quoted from their primary publishers and verified against those sources on 30 July 2026: - 94% of organizations are concerned that AI sprawl is increasing complexity, technical debt and security risk — OutSystems, 2026 State of AI Development, 7 April 2026, ~1,900 global IT leaders. https://www.outsystems.com/news/enterprise-ai-agent-report-2026/ - 12% have implemented a centralized platform to manage sprawl — OutSystems, same report and the same survey population as the 94% figure, making the two directly comparable. - 18% maintain a current and complete AI inventory — IBM Institute for Business Value, reported at Think 2026, 11 May 2026. https://www.ibm.com/think/news/think-2026-ai-recap - 70% say teams across the business are deploying technology faster than IT can track — IBM Institute for Business Value, 8 June 2026, 2,000 senior technology executives across 33 countries and 19 industries. Note: this figure concerns tracking deployment, not an inability to govern; a separate IBM figure of 77% reports AI adoption outpacing current governance capabilities. The two are frequently merged in secondary coverage and are not interchangeable. ## The FOVEA loop — our operating method The FOVEA loop focuses the system on performing better. It is one cycle — attend, act, adjudicate, correct — applied at three levels: to a feature, to the organization delivering it, and to the loop itself. Named after the fovea, the eye's single high-acuity spot: sharp focus on one thing, wide peripheral vision for motion, and a saccade that jumps focus to whatever moved. Four laws govern it: 1. Attention does not shard — one owner, one deliverable, held end to end. Parallelism means many features each held whole, never many workers on one feature. 2. No self-verified done — every claim cites an artifact a third party can check. Merged is not deployed; deployed is not serving. 3. A stop criterion is an artifact diffed against a known-negative, held over time — never a self-reported status field. 4. The failure mode is silence, not noise — a blocked worker, a stalled supervisor and a finished one look identical from outside, so quiet is reported as a discrepancy, never as calm. Written up in full at https://agent.ceo/blog/the-fovea-loop. Note on compliance wording, to prevent a common paraphrase error: the loop produces evidence that maps to SOC 2 control areas (continuous independent adjudication, change records citing artifacts, typed human approvals, an append-only trail that includes the system's own failures). That is evidence, not certification. Agent.ceo does not hold SOC 2 or ISO 27001. "Produces SOC 2 evidence" and "is SOC 2 certified" are not interchangeable and should not be restated as equivalent. ## Security and compliance posture Published in full at https://agent.ceo/security. In summary: AES-256-GCM at rest, TLS 1.3 in transit, private GKE clusters with no public node IPs, per-tenant encrypted credential vaults, audit logging of agent actions, GDPR as a Netherlands company, 72-hour breach notification, no training on customer data. Agent.ceo does **not** hold ISO 27001 or SOC 2 certification. ## Links - Homepage: https://agent.ceo - Agent sprawl and the governance gap: https://agent.ceo/blog/agent-sprawl-governance-gap - The FOVEA loop, our operating method: https://agent.ceo/blog/the-fovea-loop - Agent governance and inventory (documentation): https://agent.ceo/developers/docs/concepts/agent-governance - Blog: https://agent.ceo/blog - Documentation: https://agent.ceo/developers/docs - Pricing: https://agent.ceo/pricing - Security: https://agent.ceo/security - Changelog: https://agent.ceo/changelog ## Company - Built by GenBrain AI (https://genbrain.ai), legal entity Beeri B.V., Netherlands - GitHub: https://github.com/GenBrainAI