Request early access

You write agents. We run them.

Isolated, observable, human-gated and metered down to the token, so your team ships business outcomes instead of infrastructure.

You bring a git repository and one elan.yaml; Elan builds it, provisions what it needs, and gives you an address to invoke it at.

Request early accessRead the docs
agents/invoice_triage/agent.pyGoogle ADK
# agents/invoice_triage/agent.py
from agentkit_core.manifest import (
    AgentManifest, Billing, Limits)

MANIFEST = AgentManifest(
    slug="invoice-triage",
    version="0.1.0",
    model="gemini-flash-latest",
    limits=Limits(max_concurrent=4, timeout_s=120),
    billing=Billing(sku="agent.chat.standard"),
)

def build(ctx):
    return LlmAgent(
        name="invoice_triage",
        model=ctx.model,   # one source of truth
        instruction=INSTRUCTION,
        tools=[look_up_order],
    )
$elan deploy

Why now

Agents are a new kind of workload.

For a decade, infrastructure has been built for two shapes of software: stateless microservices that answer a request and forget it, and batch jobs that run to completion and stop. Agents are neither.

  • They accumulate stateA conversation is the unit, not a request. What happened earlier decides what happens next, and it has to survive a restart.
  • They decide, so they need isolatingNobody wrote the next step line by line. Model-driven code running beside other people's needs a boundary a library cannot provide.
  • They reach out across the internetModel APIs and tool servers, from a process that should be allowed to reach those and nothing else.
  • Increasingly, they actThey refund, book, charge and email. An action a person would have signed off needs somewhere to be signed off.
  • Unwatched, they burn money in a loopA retry that calls a model is a cost that compounds. Somebody has to be able to see it and something has to be able to stop it.

Putting that workload on infrastructure designed for something else is how teams end up with an impressive demo and nothing in production.

Why developers choose Elan.

Build, deploy and scale with confidence.

  • Ship in one commandWrite the agent. One command takes it to production — no Dockerfile, no Kubernetes, no Terraform, no CI pipeline.
  • Keep your marginBring your own model keys. Your provider invoices you directly, we never see that bill, and we take no share of it.
  • Safe by constructionIts own kernel boundary, no inbound path at all, default-deny egress. Not a rule your dependencies could decline to follow.
  • Get paid for your agentsPrice a run and charge the person who used it, on a managed double-entry ledger. No billing system to build.
  • See everything it didEvery run on the record: what it cost, which build served it, and where it stopped to ask somebody. Failures included.
  • Pay nothing while idleScale to zero is the default, so an idle agent costs the storage it holds and nothing else.

A prototype is an afternoon. Production is a platform team.

You write the tip. Everything beneath it is ours to build, run, patch and pay for.

You write one agent file and one project file. Beneath them sit the runtime and sandbox, the image build, the queues and event stream, the databases and secrets, and the cluster itself — all of it ours.cluster, network, identitydatabases, file storage, secretsqueues, event stream, sessionsimage build, scan, signatureruntime, sandbox, autoscalingagent.pyyoursours

Two files, that’s it.

Each target declares itself twice, split by who enforces what — and no field appears in both, which makes the pair a validation rather than a duplication.

MANIFEST · what it isBeside the agent, in its own code: the model, the tools, the limits, the prices, and what it may do without asking.
elan.yaml · what we permitOne per repository: how big, how many, which models, which hosts it may reach, which secrets to inject.

Elan brings the platform engineering.

Every line below is already written and already yours to use — and crossed off the list you would otherwise be maintaining.

  • a Dockerfile
  • a Kubernetes manifest
  • a Terraform module
  • a CI pipeline
  • a usage meter
  • an approval queue
  • a billing system

There is deliberately no way to supply your own build — partly because a tenant-supplied one is an attack surface we decline to have, and partly because owning the layer order is what makes one image per repository cheap to rebuild.

Spend your time on the business problem.

Without Elan, your engineers become platform engineers. With it, getting to production takes four commands.

  1. elan init
  2. elan validate
  3. git push
  4. elan deploy

Agents are written in Google ADK, so there is no new framework to learn, no Dockerfile and no Kubernetes YAML. Rollouts move a canary first, idle agents scale to zero, and every agent rolls back on its own.

Hyperscalers give you parts. Elan gives you the platform.

Elan runs on proven cloud infrastructure. The difference is that it arrives already assembled, secured and shaped for agents.

What you deployRaw cloudContainers and functionsElanAgents and workflows
Agent isolationRaw cloudYou design itElanA kernel sandbox and no inbound path, by default
Outbound controlRaw cloudYou wire it per serviceElanDefault-deny, with the model hosts added for you
Human approvalRaw cloudYou build itElanBuilt in, enforced per tool call
Per-version tracingRaw cloudYou instrument itElanEvery event carries its version and image
Charging your usersRaw cloudYou build a billing systemElanWallets, prices and a ledger, declared in code
Model choiceRaw cloudWhatever the managed service supportsElanBring your own key, any supported model

See how it works.

A short introduction, if you would rather watch than read.

An agent that can act needs a story about consent.

Every tool call resolves to one of three answers, per call, against the arguments of that particular call.

  • refusethe tool stays put, and your agent says why
  • aska person decides, and the run waits where it stood
  • allowit runs straight through, and is recorded

So “refunds under a thousand run themselves and bigger ones wait” is a declaration rather than an if your model can be talked out of. A ceiling bounds how far any stored policy may loosen a tool, and a refusal its author declared cannot be dropped downstream.

Monetize your agents.

Put a price on a run and take money for it. You do not build a billing system to do that, and we do not take a cut of what you charge.

A managed ledgerDouble entry, holds, settlement and wallets, kept for you. There is no billing system for you to build, run or reconcile.
Collect from your end usersDeclare retail prices in the agent's manifest and the platform debits the person who used it, keyed on whatever you already call them.
We charge you for the platformOur invoice covers what the pods reserved and the tokens they metered. What you charge on top is yours, in full.

A deposit first, then the real cost.

Reserving before the run is what makes this a ledger rather than a counter: a payer who cannot cover it is refused before the first token, and whatever the deposit over-reserved goes back.

A deposit is reserved against your user’s wallet before the run starts, so a payer who cannot cover it is refused before the first token. The run is metered as it goes, the real cost is settled once, and whatever the deposit over-reserved is released back to them.whatever the deposit over-reserved, releasedTheir walletcredit they holdReservea deposit, up frontRunmetered as it goesSettlethe real cost, onceopen a holdcleared to startusagenot enough credit — refused before the first tokennothing ran, so nothing is owed

See everything your agent did.

Every run reads back as a trace: what ran, inside which node, what it cost, and where it stopped to ask somebody.

A trace of one run: it was queued, a node ran, a model was called, a tool looked up an order, the run paused for a human to approve something, the model was called again, and it finished. Every row carries what it cost. The wait for the human is marked rather than timed.one invocation3.4s · 4,812 tokens · $0.00210.0s0.8s1.7s2.5s3.4squeued0.1sinvoice_triage@12.9s└ model call2,104 → 311└ look_up_order0.4s└ waiting for a humannot timed└ model call2,290 → 107finished0.1s
ObservabilityEvery run with what it cost and which build served it, traced step by step. A failed run’s duration is time-to-failure and never shares a percentile with the successes.
AnalyticsSpend by SKU at a time grain you choose, success against failure over time, and per-version rollups — so a regression shows up as a shape on a chart rather than as a support ticket.

Your keys, your margin.

Bring your own model keysYour provider invoices you directly. We never see that bill and take no cut of it, so your floor is their price list and the margin above it is yours.
Nothing reserved when idleScale to zero is the default, so an idle agent costs nothing but its storage. Ask for a warm replica on the ones that must answer immediately.

Who it is for.

  • Product engineers

    who want an agent in front of real users this week, and do not want to become platform engineers to get there.

  • Platform teams

    asked to let five product teams ship agents without giving five product teams cluster access.

  • Enterprises

    who need the thing running model-driven code to be isolated, auditable, human-gated where it acts, and attributable to a cost center.

Questions.

What do I actually write?

Google ADK agents, in Python. The platform does not wrap the framework in a DSL of its own, so what you learn is ADK and what you keep is ADK. Beside each agent you write a short manifest saying what it is, and one file per repository saying what the platform may permit.

Do I bring my own model keys?

Yes, and that is the arrangement rather than a limitation. Your provider invoices you directly, we never see that bill, and we take no share of it — so your floor is their price list and the margin above it is yours. Your key is stored as a secret and injected; the model's hostnames are opened for you.

What does the platform charge me for?

The CPU and memory your pods reserve, plus a small per-request charge on the wallet API if you use it. Billed on what you reserve rather than what you use, which makes your bill a function of a file you control and can reason about before deploying. Model tokens are not on it.

Why doesn't my agent get an HTTP endpoint?

Because an endpoint is something an unauthenticated caller can arrive at. An invocation is a message your agent pulls from a queue instead, so there is no port to scan and nothing to brute-force — the attack surface is empty by construction rather than by a rule somebody maintains. Your replies come back on an event stream.

How isolated is my agent from everybody else's?

It runs behind its own kernel boundary, in a namespace of its own, with one database and one file prefix nothing else can read. The honest exception: agents you deliberately group into one process share an identity and a database with each other. Group the ones that already trust each other.

Can I charge my own users?

Yes, and without building a billing system. Declare prices in your agent's manifest, give a user a wallet keyed on whatever you already call them, and pass their id when you run it. The platform keeps that ledger on your behalf and none of it reaches your invoice from us.

What happens to my data if I leave?

Removing a project removes what was provisioned for it — the database, the queues, the secrets and the identity — and tells you exactly what goes before asking you to type the name. The database is snapshotted first and the snapshot kept for ninety days, so a mistake is recoverable and a departure is final.

Is it ready for production?

It is in early access, and we would rather say so than publish an uptime guarantee we cannot yet stand behind. What we do commit to is telling you when something is broken and treating downtime as our failure rather than yours. If that is not enough for what you are building, tell us what would be.

Build on it early.

Elan Platform is opening to a first group of developers. Tell us what you are building and we will be in touch with access.

Startups: a chance to win up to $1,000 in platform credits.

Request early access