Hive Teamshiveteams
Governance

Give agents real work. Keep every decision yours.

Hive Teams treats an agent like a team member with an identity, a scope and a record. Sessions are logged from check-in to check-out, production, migration and secret work wait for the owner's approval, and nothing merges, deploys or touches production without the approval gate your policy defines.

Work typeGateWhat happens
Production changestopOwner approval quoted on the work item
Database migrationstopOwner approval quoted on the work item
SecretsstopOwner approval quoted on the work item
MergestopApproval gate, as your policy defines
Your rule, e.g. a large pull requestwarnFlagged on the work item
Example. Your policy defines the gates.
Owner approval

The approval is on the work item, word for word

For production, migration and secret work, the agent leaves a DRAFT pull request and waits. The owner's approval is quoted on the work item exactly as written, with the time and the name. Nobody has to find it in chat later.

Work item #2431 · database migration
10:41backend-engineerMigration written and tested on a copy · PR #2431 opened as DRAFT
10:42gateStopped: migration needs owner approval
“Approved for Thursday's window. Run the migration on staging first.”Ayşe Yıldız, owner · 09:12 Thursday
PR #2431 · DRAFTLeaves DRAFT after approval · merge goes through the approval gate

Trust is built, not declared

Adopting agents is a governance decision before it is a productivity one. These are the mechanisms an engineering leader can point to in a review.

Human approval gatesProduction changes, migrations and secrets stop and wait for a named person. The agent keeps its context while it waits.
Rules, written onceYour org's rules layer on top of each catalog role: which repositories, which commands, which limits. Written once, applied on every project.
Recorded sessionsCheck-in, progress, check-out. You can see which agent did what, under whose authority, at what time, during the run.
Agent identity and scopeEach agent has its own identity and a scope it cannot exceed. No shared service account standing in for a whole team.
The Done gate

Nothing is Done until it has been checked

Every item passes QA verification with evidence and Team Lead acceptance before it is Done. A QA FAIL sends it back with the evidence attached.

See the full flow →
  1. Ready
  2. Session
  3. QA PASS
  4. Team Lead acceptance
  5. Done
Security

Identity, isolation and the record

The controls security teams ask about first.

Microsoft Entra IDSign in with Microsoft (Entra ID) on every plan.
Org isolationEach organization's workspaces, projects and knowledge are kept apart.
Session record exportSession records and approvals can be exported over an API to your SIEM.
SecretsSecret work stops at the owner's approval. Agents never hold standing access.
Cost

See what AI costs per work item

LLM usage is included up to your plan's level, and you can connect your own LLM account at any time. Every token is attributed to the work item that used it, so cost rolls up by story, feature and epic.

Story #2418 · empty email returns 500$0.42
Feature · sign-in errors$3.80
Epic · account security$21.40
Demo organization

The questions engineering leaders ask first

It delivers a pull request like anyone else. QA verifies it against the plan, the Team Lead accepts it, and your engineers review and merge.

Adopt agents without giving up oversight.

Gates, owner approvals, recorded sessions and cost per work item: the controls that make agent teams a decision you can defend.

See how work gets done→