Security and trust
You hold the keys. We just make them safer to use.
LimberOps changes the identity settings that protect your clients. Here's how we keep that power in your hands.
Nothing applies without your approval
Every change is a plan your own team approves, or a schedule or rule they approved in advance. No AI or teammate pushes a change on their own.
Read-only first
Start with inventory and sign-in simulation. Turn on write access per tenant, only when you are ready.
Your code, your repository
Configuration is plain Pulumi in Git. Export it any time. No proprietary format, no lock-in.
How it's built
Controls in the product, not just the policy.
Least privilege, step by step
Each tenant or organization is connected through its own consent. Read permissions come first; write permissions are a separate consent you grant per tenant, only for the areas LimberOps manages.
Isolation between clients
Every client has its own repository, its own state and its own credentials. A plan for one tenant cannot touch another.
Every change is a reviewed plan
Changes are previewed, checked against guardrails and simulated before someone on your team can approve them. A failing check blocks approval.
AI under the same rules
The AI drafts plans and runbooks from your inventory. It never applies anything. Its drafts go through the same preview, checks and approval as a human change.
Sandboxed scripts (in development)
Runbook script steps will run in an isolated sandbox per run, against previews or recorded fixtures, and never against a live tenant without an approved plan.
Complete audit trail
Who requested a change, what it contained, which checks passed, who approved it and when it applied. Kept per client, ready for the next audit.
Plain promises
What LimberOps will never do.
If any of these change, we'll tell every customer before it happens.
- ✕Apply a change nobody on your team approved
- ✕Write to a tenant before you turn on write access
- ✕Keep your configuration in a format only we can read
Make your next tenant change the boring kind.
Connect one tenant or organization, read-only, and see its configuration as code before you change a thing.