One director you chat with, a crew of agents that does the work, and a person who signs off before anything goes out.
The three layers
Denkploeg is built from the ground up for several clients side by side. That separation is not a setting, it is the shape of the system.
| Layer | What it is |
|---|---|
| Platform | The code. One version, the same for everyone. |
| Agency | An agency. Has clients, a house style and an account. |
| Workspace | One client of that agency. All data hangs off it. |
A workspace is the sharpest boundary there is. Every question, every file, every connection and every line in the trail carries it along. No search looks across it, and that is deliberate: the clients here are each other's competitors.
The gate
The crew reads and proposes. If it wants to do something that has an effect on the outside world (place an order, publish a page, run a command), a card with two buttons goes to a person, and nothing happens until someone clicks.
- ProposalThe crew proposes what has an effect on the outside world.
- SigningA person clicks. Until then nothing happens.
- ExecutingThe runner claims the proposal exclusively and executes it.
Three things make that more than a promise:
- The question lives in the database, not in a process's memory. A restart does not drop it, and an unanswered question expires instead of hanging around forever.
- Execution is separate from the conversation. You can kill the agent process between the proposal and the signature, sign afterwards, and it still happens.
- A signature belongs to a person. No tool can issue one, not even through the MCP server.
What the crew may never do
Not "not yet", but never, and the reason is given.
A proposal without a gate is not a proposal.
| Write to a client system without a signature | A proposal without a gate is not a proposal |
| Run a command outside the agent process | A process with a shell reads the environment variables of other processes, and those contain keys |
| Look across the boundary of a workspace | See above |
| Change a client's house style automatically | A series of taste judgements must not quietly rewrite a brand |
What happens behind the gate
The runner is a separate process without a model. It picks up signed proposals, claims them exclusively and executes them. If it cannot determine the outcome (it went down between the call and the answer), it sets the proposal to uncertain and leaves it to a person.