marinoseliades

More on this, we're still experimenting between a hard vs. soft paywall. Regardless, if you sign up it should be easy enough to play around with it for a while on the free tier. We promise that we don't send spam/marketing emails.

Heard, we're actively working on this and should have updated pricing plans soon.

Thanks! Custom beats generic if building it takes days instead of months.

Fair, the generation part is commoditized. What we sell is the trust layer around company data. No credentials in the builder's hands, scoped access per tool, forkability etc. CC + Railway works until someone pastes a prod key into an env var.

Thanks! The private endpoint tip is very much on point. We've already hit two prospects where the blocker was that they don't want full self-host but their security groups won't take generic cloud egress. It's on the list.

You're right, and we don't. The judge is best-effort screening not enforcement. Enforcement is deterministic with per-tool Postgres roles, proxy-injected creds, host allow-list, human approval on destructive writes. Those hold whether the judge is right or wrong.

The difference is Retool still basically trusts whoever (or whatever) is building the app, we don't. The agent writing the code never sees a credential and each tool gets its own Postgres role. Even if it generates something dumb it physically can't touch data outside its scope.

We ended up splitting permissions per-tool for data and per-person for connections, for basically this reason. Every tool gets its own db role that can only see its own schema, and integration credentials live in a broker the tool's code never touches. So one tool can't read another tool's data, and nothing the model writes can leak a credential.

The ordering thing is harder and currently we don't do it. Per-tool permissions at best ban a combination, they can't say "internet then Slack is ok, the reverse isn't." DeepMind's CaMeL paper (arxiv.org/abs/2503.18813) is the best take I know on this, it tracks data flow between tool calls and enforces policy there. Still an open problem as far as I can tell.

Closest comp. I'd argue the "AI builds the app part" is fast becoming table stakes. The unsolved problem is what happens after the app exists and that's what we actually built. Anyone in the org can fork a coworker's tool and rebind it to their own data scope. Enforcement also happens at a different layer. From what we've gathered, Superblocks controls who can run an app and bakes guardrails in when the app is generated, but every app still queries through a shared database credential. On our side, each tool gets its own database role that can only see its own data, and credentials live in a proxy the code never touches. So even when the AI writes bad code, it can't reach anything it shouldn't.

Thanks for the feedback. From what we've gathered so far, non-eng are using CC or Codex to build one-off internal tools, but they're deploying them on their personal Vercel accounts and sending the url over Slack. That's the workflow we want to replace with a reasonable level of security and auditability. We're still trying to gauge interest in using the CLI to build and having everything deploy on Prized, we're working out whether that's valuable.

Today it's GPT-5.6 Luna sitting inline on the egress broker, with Terra re-judging anything Luna flags as ambiguous. We are still experimenting though.

Thanks! That's the best kind of validation. If you ever take Prized for a spin, would genuinely love to hear how it compares to what you built, especially on the data access side.