Run governed AI work from your own systems

The problem

Teams want AI work triggered from their own tools, not another tab. But handing a script an API key must not become a way around budgets, approvals or roles.

API keys that cannot outrun their owner

• Scopes: tasks:create, tasks:view, tasks:estimate and approvals:decide.
• A key acts as its creator: a request needs both the key's scope and the creator's current role and active membership, re-checked on every call. Demote or remove the person and the key loses power immediately.
• The creator's per-task spend cap applies to API-created tasks.
• Only a hash and a public prefix are stored; the raw key is shown once. Unknown, revoked, expired and orphaned keys return the same 401.
• Task creation supports an Idempotency-Key header, so a retried request does not create (or pay for) a second task.
• No separate business logic: the API calls the same task service as the dashboard, so budgets, approval gates and the Circuit Breaker apply identically.

Webhooks

• Events: task completed, partial and failed; approval requested; Circuit Breaker triggered.
• Signed: HMAC-SHA256 over the timestamp and body. Secret rotation keeps the old secret valid for a 24-hour grace period.
• Reliable: failed deliveries are retried on a backoff schedule, up to six attempts, and every attempt is itself recorded as an event.
• Safe by design: delivery refuses private and internal network targets, does not follow redirects, and times out after 10 seconds.
• Quiet when unused: with no subscribed endpoint, nothing is created, sent or logged.

Limitations and trade-offs

• The API operates in ThreadPool's virtual token economy; it does not move real money.
• Webhook delivery is retried until it succeeds or attempts run out, so a receiver may see the same event more than once; make your handler idempotent.

Related

• Keep a human in the loop on AI agent spend
• Give every team member the right amount of authority