Know what your
agents did.Prove it.

“What did your AI do on my account?”

You run four companies, or six clients, or fifty. Agents touch their data every day — drafting, sending, filing, deciding. Then the question lands, and the honest answer is a scroll of chat history that proves nothing.

• → An agent acted on client data. There was no gate, and there is no log.
• → The permissions live in a prompt, so nobody can state them, let alone enforce them.
• → The record you'd need is spread across four tools and three chat windows.

Thornbury Ledger is not a chat interface, not a router, and not a platform. If a feature doesn't get better as your context count rises, it doesn't ship.

The authority matrix, live.

This is the actual shape of the product — and the way Thornbury governs its own agent org. Click any cell to change what that agent is permitted to do. Every change writes an immutable, hash-chained decision record.

Click cycles: allow → gate → deny. Keyboard accessible.

Demonstration hash chain, computed in your browser. Nothing on this page is transmitted anywhere.

We segment by concurrency, not company size.

A context is anything with its own credentials, data, voice and rules. One client. One company. One brand. Drag to find yourself.

Thornbury stores no provider credential. Any tier.

Not a policy we could quietly change — an architecture. Watch where the key actually goes.

Before the first paid customer: encryption at rest, per-tenant isolation at the query layer, a published data-handling page, a documented deletion path. Not SOC 2 — that comes when a deal requires it, and we will say so plainly rather than imply otherwise.

One question kills most roadmap requests.

Does this get more valuable as context count increases? No is a complete answer, logged and returned with thanks. Try it on a feature you'd want.

Services now. Product next. In that order, on purpose.

The engagement phase isn't a placeholder while we build — it funds the runway and writes the product spec. Every engagement is requirements authored by a paying customer.

Honest timeline to usable alpha: 4–7 months, wide bars, planned against the top of that range. Built as a fork of LibreChat — we build the governance layer, not another platform. AGPL from the first commit.

The free tier isn't crippled. That's the point.

Full governance — matrix, gates, decision records — at zero. We charge for depth and for the managed version, never for the ability to prove what happened.

A source-available AGPL self-host arrives around month 9–12, deliberately unmarketed: public repo, README, no support, no SLA. Self-hosting stays free — anyone offering Ledger as a service has to open their changes.