Understand and control your agents down to each action they take.

Cost doesn't live in your tools — pure API and database calls are effectively free. It lives in model calls, and most of those are the orchestration loop re-reading its growing transcript to decide what to do next. ACP splits every run into the loop vs the leaf sub-tasks — so you can see the real driver and move the cheap, bounded work to a cheaper model.

• Loop vs leaf on every run — the orchestration loop is usually most of the bill
• Loop tax: the share of tokens spent just re-reading context
• Budget caps that halt the run, deterministically — not just a warning
• Prices subscription traffic too — your Claude Code Max session, shown at API rates, billed to you exactly as before

Autonomous agents act without you watching. One bad tool call drops the table, emails the customer, leaks the key. ACP enforces your rules on every call — deterministically, before it runs: allow the safe ones, block the dangerous ones, redact what shouldn't leave.

• Default-deny on destructive tools — fs.delete, shell.exec
• Redact PII & secrets automatically, in and out
• Real identity carried through every delegation hop

Every request a coding agent makes declares its full tool catalog — the model can't call what it can't see. A real Claude Code session declares 76 tools: the coding loop, yes — and tools that send messages, publish public web pages, schedule their own future runs, and drive your logged-in browser. Most were never invoked. All of them are standing open.

ACP captures the declared surface on the agent's first call — before anything runs — and turns it into a control table: every tool a click to allow, flag, or deny. When the surface drifts mid-session (we've watched one gain 21 tools in an afternoon), you hear about it.

• The full catalog, visible before first invocation
• One click per tool: allow · flag · deny · ask
• Drift detection — know when the surface grows