The harness, the agent team, and the trust layer.

Everything around the model

The tools an agent may call, the limits that stop it, the budget it may spend, the memory it keeps, the checks its output must pass. Every Khelion agent runs in the same harness: warrant enforced in code, budget per task, anti-loop, tests on outputs.

Narrow roles, coordinated

One small team per operational area — airside, security, baggage, passengers, safety, environment — made of agents with one job each, woken by work rather than by a timer, coordinated by an agent that routes, tracks dependencies and escalates to a named person. Deliverables land in your systems as files and entries, not in a dashboard you have to trust.

Warrant, ledger, explanation — we call it Manifest

Warrant: what the agent may read, may write, may never do, and when it must stop and hand over — written with you, enforced outside the model. Ledger: every action appended to a record that cannot be edited afterwards, each entry chained to the previous one, exportable in open formats. Explanation: for any entry, why the agent did what it did, in plain language.

Refusals, budget stops and loops are entries too. An inspector receives the warrant text, the ledger export, the explanations and the list of exceptions — without calling an engineer.

Routed by task, measured per run

Each task class goes to the smallest model and the least effort that passes its check; the most capable models are reserved for architecture and governance decisions. Every run records what it consumed. Model providers are named in the warrant, per deployment, with options that do not train on your data.

Inside your environment, on your records

Processing in the EU by default, or inside your own environment. Connections use the narrowest access you can grant, revocable by you; credentials never pass through a prompt. Read-only first; write access only where the warrant says so. No client data used to train anything of ours — contractually.

Built on the industry’s own vocabulary

The agents read the operation in the terms your contracts, systems and auditors already use: EUROCONTROL A-CDM milestones, IATA AIDX flight messages, the ACI ACRIS data model, the SGHA and service levels on the AHM 803 model, IGOM procedures. That is what lets a deployment move from one station to the next without starting over.

For ground handlers, the design follows point ORGH.MGM.220 of Regulation (EU) 2025/20 on the software they use: the operation can continue without the agent, and every record stays retrievable on request.

We run on it ourselves

Khelion is operated by eight agents — research, drafting, monitoring, finance, outreach — each with a warrant, a budget and a place in the same chained ledger we ship. When one of ours loops, refuses or overspends, we see it in the same record you would.