PALRuntimeAboutDocsGitHub

Open beta · Apache-2.0

PAL · the Personalized Agentic Layer

Agents that work for you. And only with your yes.

For you, an agent in the chats you already use that drafts, holds and asks before anything risky. Build as many as you need, then test, ship and run them on the same runtime, PAL Runtime, with your own agents.

For youYour agent in iMessage and WhatsApp.Replies in your voice, remembers your people, runs the errands you teach it, and holds anything risky for your yes.Meet PALBuild and ship agentsBuild it. Prove it. Ship it.Eval gates, promotion with approval and canary, default-deny policy, microVM sandboxes. In your cloud.Explore PAL Runtime

PAL · watch it work

It brings you what matters. It waits on what’s risky.

Ask PAL what’s up and you get a short, ranked list. When a reply would spend your money or your word, PAL stops and asks you first, in the same chat. Try it: press Send or Edit.

  • Brief. Threads waiting on you, drafts, things you said you’d do.
  • Hold. Money, promises, dates it can’t check, hard news.
  • Your call. Send it, or say it your way.
PALiMessage · self-chat

Today 8:02 AM

?

PAL

3 things need you

  1. 1⏳ Jordan has waited 2 days about Saturday
  2. 2✍️ A draft to Priya is ready
  3. 3You said you’d send Alex the slides

React 👍 to do it · 👎 skip · ⏰ snooze

Held

Maya asked for her $300 back. My reply promised money, so I held it.

“sending it tonight 👍”

PAL held a reply that promised money — send / edit?

send

PAL

Sent to Maya.

edit: let me check and get back to you tonight

PAL

Sent your words to Maya instead.

Invented example. Try Send or Edit.

PAL · your agents

One for every errand you’d rather not run.

Bills, trips, family plans, the weekly digest. Each runs in your own chat, under the same holds, quiet hours and kill switch.

  • Bills

    Bills, deliveries, appointments and fraud alerts are recognised as they arrive. For each kind you choose: act, ask first, or off.

    auto · ask · off

  • Travel

    Someone mentions a flight that’s in the air. PAL checks it live and follows up once it lands.

    “just saw he landed”

  • Family events

    A weekly scan for fairs, fireworks, community shows and kids’ events near you. Pick a number and it’s on your calendar.

    book 1,3

  • Digests

    Describe a recurring job in a sentence. PAL drafts it as a skill, and nothing runs until you approve it.

    new skill: every Friday 5pm, recap my week

PAL · personalized

It learns you, not the other way round.

It knows your people, your calendar and your mail, writes the way you write, and never says yes on your behalf.

  • Brief: you type a question mark in your self-chat. pal ranks a thread waiting on you, a draft and a promise, and replies with three numbered items. A thumbs-up drafts the reply to the top item; you say send, and it goes.

    Brief

    What needs you, ranked.

    Type ? and PAL ranks every thread, draft and promise waiting on you, with a reason. React to act: 👍 do it, 👎 skip, ⏰ snooze.

  • Holds: a contact asks for money. pal’s draft promises it, the commitment gate holds it, you get a HELD message in your self-chat, and your own words go out instead.

    Holds

    Never says yes for you.

    Money, commitments and claims it can’t check wait for you. A backstop runs even when the model is down.

  • Sounds like you: a stock-phrase draft scores 0.71, past your own p95 floor of 0.44, and is rewritten from your five closest real messages to 0.19 before it is sent.

    Voice

    Sounds like you.

    Each draft is scored against messages you really sent. One that drifts is rewritten before it goes out.

  • Memory: an iMessage number and a WhatsApp name resolve to one person with one timeline, so a later WhatsApp reply recalls what was said on iMessage.

    Memory

    One memory per person.

    Across iMessage and WhatsApp, so a plan made on one is known on the other.

  • World model: mail, calendar and your own note update a dated fact with a cited source, and three nudges arrive: a meeting in ten minutes, a thread waiting three days, an anniversary tomorrow.

    Now

    Knows what’s true today.

    A dated picture of your life from mail, calendar and your own notes, with a source on every line.

Everything PAL does

PAL Runtime · build and ship

Ship agents the way you ship software.

Build agents on the same runtime that powers PAL. Nothing reaches production without passing its evals, and prod needs a person’s yes.

01 · Build

Freeze what you built.

Define the agent in an agent.yaml or with the TypeScript SDK. Freezing snapshots the prompt, model and workflow into an immutable version, and that snapshot is what runs.

$ pal freeze support
frozen support@v7
runs and evals use this snapshot, not your working copy

02 · Eval

Gate it on evidence.

Suites run on the server with mocked tools and an LLM judge that is never the model under test. A regression against the baseline fails the run.

$ pal eval run --agent=support --suite=core --samples=3
hermetic · mocked tools · judge ≠ maker
regressed vs baseline → exit 1 (API: 422)

03 · Promote

A human says yes to prod.

Promotion checks the earlier environment, a fresh eval and the budget. Prod waits for an owner. A canary takes a slice of runs and rolls back on its own if a guard trips.

$ pal promote support --to prod --canary 10
pending_approval
waiting for a human: pal approve <id>
canary guards: error rate · cost ratio · eval floor

04 · Observe

Know when it drifts, and why.

Every run has a trace of its steps, model calls and tool calls. SLO burn and anomalies open incidents, and the debug agent explains a failure from the run’s own evidence.

$ pal debug run <run-id>
trace: steps · LLM calls · tool calls (redacted)
root cause cites run:<id> · ev:<seq> · trace · diff

Commands are the real pal CLI; output is abridged and illustrative.

PAL Runtime · in code

Cap the spend before the first call.

Create an agent, give it a hard budget, forecast a run, then run it. Over the cap, the API answers 402 and no model is called.

SDKs for TypeScript, Python and Go
import { PalClient } from "@pal-runtime/sdk";

const pal = new PalClient({ apiKey: process.env.PAL_API_KEY });

await pal.agents.create({ name: "triage", description: "Classifies support email" });
await pal.budgets.upsert("triage", {
  maxCostUsdPerDay: 25, maxCostUsdPerRun: 0.1,
  hardFail: true, // over budget → HTTP 402
});

const f = await pal.runs.forecast({ agentName: "triage", input: "invoice is wrong" });
if (!f.wouldExceedBudget)
  await pal.runs.create({ agent: "triage", input: { email: "…" } });

PAL Runtime · enterprise grade

The parts every production agent needs.

Write it on your laptop, run the same thing in your cloud.

  • Durable runs: four steps run and are journaled, the worker crashes on the send step, the recovery sweep reclaims the run, cached steps are skipped, send runs once, and a signed receipt verifies.

    Durable

    Runs that finish.

    Every step is journaled. After a crash the run resumes where it stopped; finished steps never run again.

    Read how
  • Egress: agent code in a microVM with no network device reaches the host broker over vsock. A GitHub call is allowed and gets its token injected; a POST containing card numbers is blocked; an unknown host is refused. Every decision is audited.

    Contained

    Nothing leaks.

    Code runs in a Firecracker or Kata microVM. In broker mode it has no network device; the host adds credentials the guest never sees.

    Read how
  • Guardrails: a run asks for reasoning-large, passes the budget check, the router fails over from a rate-limited provider, cost is recorded; the next run is refused with 402 and a regressed eval suite returns 422.

    Guardrails

    Spend you set.

    Over budget, a run gets HTTP 402 before any model call. Ask for a capability, not a vendor. A regressed eval returns 422.

    Read how
  • Architecture: SDK, CLI and console talk to the control plane. The data plane runs in your VPC with the workflow engine, runtime manager, microVMs and your data. It dials out; inbound connections are refused.

    Yours

    In your cloud.

    The data plane runs in your VPC and dials out. No inbound ports. Apache-2.0.

    Read how

PAL Runtime · try it

Pause an idle agent. Fork a busy one.

An idle sandbox is snapshotted and stopped, giving its compute back. Resume brings back the same VM. Forks start from one snapshot and share its memory.

—

Press Spawn to start a sandbox.

Times measured on a dev laptop under nested virtualization (Apple M4 Max, Lima; 1 vCPU, 128 MiB VM; 2026-10-27), not production hardware. Method and raw numbers.

Trust

Safe by construction, not by promise.

A rule in a prompt is advice. Everything below is enforced in code, before the side effect.

PAL · for you

  • Drafts for your OK

    Mute a channel and every reply becomes a draft you approve. Draft-confirm holds uncertain replies too.

  • Holds what matters

    Money and promises, in any language, and facts it can’t verify are held at the send boundary, even when the model is down.

  • Quiet hours

    No replies go out overnight (1–6 AM by default). What arrives is queued and answered in the morning.

  • Kill switch

    Type “kill switch on” in your own chat and PAL ignores everything until you release it.

  • Raw data stays home

    The bridges run on a Mac you own and read only the folders you allow. The most personal memory is encrypted at rest.

PAL Runtime · build and ship

  • MicroVM isolation

    Agent code never runs in a bare container: Firecracker or Kata, an egress allowlist, secrets by reference.

  • Default-deny agents

    Every agent is a principal with short-lived tokens. New agents may use no tool, host or secret until policy allows it.

  • Tenant walls

    Row-level security on every tenant table. Mutual TLS and a service token on every internal gRPC hop.

  • Signed receipts

    An Ed25519 receipt over the hash of a run’s journal. Change one row and it stops verifying.

  • Read every line

    Apache-2.0. Go, Rust and TypeScript, with tests and linters gating every change.

Security model

Open beta

Where it stands, plainly.

No customer logos, user counts or invented numbers. This is what you get today.

  • Open source, today

    Apache-2.0. Run the whole stack on your laptop with Docker, or deploy it with Helm.

  • PAL needs a Mac

    The iMessage and WhatsApp bridges run on a Mac you own. There is no hosted PAL yet.

  • SDKs from source

    The SDKs aren’t on npm or PyPI yet. Install them from a checkout of the repo.

  • You run both planes

    There is no managed cloud endpoint yet. You deploy the control plane and the data plane.

60 seconds

Run the whole stack on your laptop.

Docker only, no API key. The demo starts the control plane, the console and a model server that replays recorded answers. Each visitor gets a private workspace, deleted after 30 minutes.

Read the quickstartView on GitHub
# needs Docker and openssl
git clone https://github.com/dshakes/pal.git
cd pal
make demo
demo: http://localhost:3001/kiosk

# stop and delete all demo data
make demo-down
git clone https://github.com/dshakes/pal.git && cd pal && make demo

PAL runs on PAL Runtime.

The agent that answers for us every day runs on the same open layer you can build and run your own agents on.

Meet PALExplore PAL Runtime