Who approves what an agent touches? Governance for an open source Claude Cowork alternative

Before an agent can touch a customer record, a payment or your main branch, someone has to decide it is allowed to. Claude Cowork, ChatGPT Work and Google's agent tiers each answer that inside a vendor console. Kortix is the open-source AI Operating System, the leading open-source alternative to Claude Cowork and ChatGPT Work, and it answers the same questions with configuration a team owns: one git repo where scoped access, approval gates and an audit trail are files you can read, diff and review.

Who approves an action is the governance question

Claude Cowork is a desktop agent. Anthropic's own guidance says a Cowork session runs in the cloud on Anthropic's servers, and Claude reaches your files, browser and apps through the Claude Desktop app. ChatGPT Work and Google's Gemini agent are hosted: OpenAI runs Work in its cloud and governs it from the admin console, and Google's agent executes inside an "Agent Sandbox" with all traffic passing through an "Agent Gateway" that enforces policy as the agent works.

Each of those is a real control, and each lives in the vendor's product. That works for one tool. It gets harder when a security review asks three concrete things about a single action: which tool did it, who let it, and where is the record. Those are approval questions, and they are what governance means in practice.

Four controls that make approval concrete

Scoped connectors instead of raw API keys. A raw API key sitting in an agent's environment is the whole account in one string, so one prompt that talks the agent into printing it has the account. A scoped connector grants reach into one named app instead. Kortix reaches 3,000+ apps in a click, plus MCP, OpenAPI, Postman, GraphQL and raw HTTP, and every tool call carries a policy. Set each tool to Allow, Ask or Block, down to the arguments of each call. An Ask holds the call: the agent's turn pauses and resumes once a person decides.

Credentials held outside the machine. Where a credential sits decides who can read it. Kortix keeps the sensitive half out of the agent's workspace: connector credentials are brokered server-side and never enter the machine, and secrets are encrypted at rest with a key per project. An agent that holds a live key on the machine it runs on can be talked into exposing it, and a brokered credential never reaches that machine in the first place.

An approval gate before work lands. The decision that matters is the one right before a change lands, and Kortix puts it between the agent and your default branch. Each session gets its own cloud computer and its own branch, and session work reaches main through a change request. Merge is default-deny for agents. Approval gates you set. Off until you set them. An agent can edit its own configuration on its session branch and propose the change. A person approves it.

An audit trail. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan, so how much a team can pull back depends on what it bought, but the recording itself is not optional. That is the record a review asks for: which agent, which tool call, which approval.

Where the rules live is the real difference

The closed platforms ship these controls too, and the difference is where the rules live. Cowork gives you three approval modes, "Manually approve", "Automatically approve" and "Skip all approvals", and Anthropic sorts tools into read and write, recommending human oversight for the high-stakes ones. ChatGPT Work keeps orchestrator controls such as approvals and web search in a Global admin policy. Google's agent applies a policy once in the Agent Gateway and applies it to every agent in the company.

In Kortix the rules are files. A project is a git repo with kortix.yaml at its root. Agents and skills are markdown, and kortix.yaml declares the machine image, connectors and triggers, and secret names and grants. Secret values never appear in the repo. So a permission change shows up as a diff you review, in the same repository as the rest of the project. Run it on Kortix Cloud, in your VPC, or on your own on-prem network, and the rules travel with the repo. Per-resource permissions for people and agents. Roles, groups, and an audit trail.

The controls, side by side

What to ask before you choose

Governance reduces to four questions a team can put to any vendor, hosted or open source. Where do the rules live, and can I version them? What can a credential reach if it leaks? Who approves an action, and is the default open or closed? What does the audit record hold, and who can read it? A hosted agent answers those inside its product. An open-source system answers them in a repo you own, with one place to change the answer.

If you are weighing the move off Cowork, the data and privacy guide walks through where a session's data goes and what you own instead, and self-hosting Kortix covers the install on your own box. The code is open source: read it, fork it, audit it. Start on the managed cloud with Try Kortix.