The AI-native Global Capability Centre platform
Design, launch and run a GCC on one system: the organisation, its centres, people, work, governance and measures. A strategy agent drafts the launch plan, business agents handle the daily load, and every consequential act waits for a named person with the permission.
Agents propose. People decide. Every agent runs in the Agent Control Plane, which owns identity, policy, approvals, audit and cost. GCC-in-a-Box never reimplements them.
From a questionnaire to an approved, applied centre
Ten steps go to the GCC Strategy Agent. It returns a recommended structure, headcount plan, role plan, hiring sequence, operating model, automation opportunities and a 90-day roadmap, with its assumptions and risks. Fifteen checks grade the answer before any person sees it.
- CompanyWho the centre serves and why
- LocationCity, entity, time zone
- FunctionsEngineering, finance, HR, support…
- HeadcountTarget and phasing
- RolesSeniority mix per function
- BudgetThe envelope the plan must fit
- Hiring planMonthly hiring capacity
- TechnologyStack and data residency
- Operating modelCaptive, hybrid, build-operate-transfer
- AI opportunitiesWhere a human must stay in the loop
Graded before it is read
Headcount within target, entries that sum, every function covered by structure and roles, hiring waves ordered and within capacity, budget within envelope, human-in-the-loop respected, a roadmap that covers ninety days in order. A plan that fails its own checks cannot be sent for approval.
Approved by someone else
Separation of duties is on by default: whoever requested approval cannot grant it, even an administrator. Turning it off is itself a governance control, audited with the previous value, and a permitted self-approval is still recorded as one.
Applied in one transaction
Approval creates the centre, locations, departments, teams, roles and open seats together. No auto-apply, no silent undo, and with no control plane configured the platform says so rather than inventing a strategy.
How ready are you to launch?
Tick what you already know. The wizard saves every step on its own, so nothing here blocks you from starting. It tells you what the strategy agent will need before it can produce a plan that passes.
One screen, and no figure on it is invented
Every number is produced by SQL over your tenant, never computed in the browser. A section you lack permission for never runs its query. A figure that cannot be shown says why.
Workforce
Centres, departments, teams, locations; headcount by each.
Employees
Joined in the last 30 and 90 days, without a team, without a manager, span of control.
Positions
Open, filled and closed seats, fill rate, the oldest open seat in days.
Tasks
Overdue, due this week, unassigned, blocked, by status and priority.
Approvals
Pending, oldest pending, last observed status with its timestamp.
KPIs
On track, off track and unmeasured, respecting each KPI's direction.
Activity
Latest audit events, with chain integrity recomputed on every load.
Agent operations
Runs, tools, queues and reports per agent, with refusals counted separately from failures.
Seven agents, each with a corpus that has edges
Every agent may cite only what it was handed and can say "I don't know". Each ships with an anti-pattern, an answer that reads well and is wrong, paired with the check that catches it. A check nobody has seen fire is a check nobody should trust.
HR Agent
Answers from this centre's own policies, or escalates. Sample: "How many days of leave can I carry over?"
escalates-rather-than-advises.What it can reach
- The HR case queue: an answered case is answered, never closed. Only a person closes.
- Policy documents in the knowledge layer, searched as the person who asked.
- No tool that writes.
IT Agent
Triages a request into an access proposal. Sample: a data engineer requests source-control access.
no-access-for-leavers.What it can reach
- The only agent that proposes a write: an access grant, held for a person with
access:provision. - The IT request queue.
- The employee lifecycle state, so a leaver is a leaver.
Finance Agent
Variance of budget against the ledger. Sample: quarterly budget versus actuals for the centre.
names-unreported-periods.What it can reach
- Budget lines and ledger entries for the caller's tenant.
- The reporting calendar, so a missing period is named rather than treated as zero.
- No tool that writes.
Procurement Agent
Advises the buying route against the vendor register and the competitive threshold. Sample: "Replace the laptop fleet."
respects-the-competitive-threshold.What it can reach
- The vendor register and the organisation's competitive threshold.
- Procurement policy in the knowledge layer.
- No tool that writes.
Project Operations Agent
A status report built from the tasks themselves. Sample: a database migration project.
health-matches-the-tasks.What it can reach
- Tasks, owners, due dates and blockers.
- The report queue: a drafted report reaches nobody until somebody puts their name to it.
- No tool that writes.
Knowledge Agent
Answers from indexed passages with citations, or declines. Sample: "How long are writes unavailable during failover?"
declines-rather-than-guesses.What it can reach
- Exactly what the person who asked could have read for themselves. Permission is a predicate in the query, not a filter after ranking.
- Citations that point at a page and heading path, re-checked on resolve.
- No tool that writes.
GCC Analyst
An executive brief from the estate's own metrics. Sample: a brief over this week's Command Center figures.
makes-no-claim-about-the-unmeasured.What it can reach
- Command Center metrics for the caller's tenant.
- A publication hold that cannot be turned off: the brief reaches nobody until a person releases it.
- No tool that writes.
The whole employee journey, with the guardrails in the schema
Workforce planning and recruitment
The Workforce Planning Agent proposes seats from the gap between approved headcount and current seats, within onboarding capacity. The Recruitment Agent screens applications into published bands (advance, hold, reject) and is never given a candidate's name, email or phone. Rejections and offers are held for a person by default, and there is no flag that lets an agent auto-advance.
Applicant tracking sits behind a provider seam designed for Greenhouse or Workday.
Onboarding and offboarding
Somebody becomes active only when their blocking onboarding tasks are done, and exited only when every access is revoked. That second rule is not configurable. Hiring closes the application, fills the seat, creates the person and drafts their plan in one transaction. The Onboarding Agent orders tasks from a published catalogue and never sees a name.
Performance and engagement
Cycles, goals with check-ins, self and manager assessments, calibration and publication. The Performance Review Agent drafts a cited summary and has no rating field: no agent produces a rating, and there is no flag that lets one. Surveys are anonymous in the schema, with a five-response floor that can be raised but never lowered.
An agent gets exactly what the asker could read
Ingests PDF, Word, Markdown, plain text and HTML, and web pages from approved origins only. Structure-aware chunking that never spans two pages. Hybrid retrieval over four classifications, with permission checked inside the query so a hidden document never affects ranking or counts. Citations resolve to a page and heading path. Documents are withdrawn, never deleted.
Note The shipped embedding provider is lexical and says so on every result; a semantic provider is a configuration change.
A roster, not a list of agents
Every rostered agent has a named owner or shows as unowned. Health is derived on every read with reasons. Dependencies are declared in code, so a missing required one makes the agent blocked and a missing optional one degraded. Schedules run in UTC, integration triggers are always held for a person, and a run carries the authority of whoever wrote the schedule, re-read at run time. Escalations end at a person. Cost is labelled modelled, never metered, and never shown as zero.
Eight providers, zero stored credentials
An integration holds a credential reference, resolved at the moment of use; a raw secret is refused three times, by the contract, the service and the database. An arriving event is written down, never acted on. An integration nobody has verified says so rather than showing green.
Slack
Post messages, set topics. Mentions, messages, channel and membership events.
Microsoft Teams
Post to a channel, message a person. Message change events.
Microsoft 365
Create and disable accounts, revoke sessions. Directory change events.
Google Workspace
Create and suspend accounts, add to groups. Directory change events.
Jira
Create, comment, transition. Issue and comment events, unsigned deliveries refused.
GitHub
Open, comment on and label issues. No code writes. Issue, pull request, push and release events.
Zoom
Schedule and move meetings. Meeting lifecycle and participant events.
ServiceNow
Raise incidents, add work notes, reply to callers. Incident lifecycle events.
Fifteen controls, honestly labelled
Each control is marked built, partial or the deployment's responsibility, with the gaps as prominent as the rest and the order they are being closed in.
Swipe sideways to see the whole table.
| Control | Status | What it means |
|---|---|---|
| Role-based access | Built | Six roles; a route audit stops the server starting on an unclassified route |
| Tenant isolation | Built | Application scoping, forced row-level security, composite foreign keys |
| Encryption | Partial / deployment | TLS and at-rest encryption are the deployment's; the MFA secret is encrypted by the application |
| Secrets management | Built | References only, never credential material |
| Audit logs | Built | Append-only, hash-chained, integrity recomputed on every view |
| Single sign-on | Built | Per-organisation OIDC with PKCE |
| Multi-factor authentication | Built | TOTP with recovery codes |
| SCIM 2.0 provisioning | Built | Users; groups are roadmap |
| IP restrictions | Built | Per organisation |
| Data retention | Built | Configurable, with traces the one agent record that expires |
| Data residency | Built | Off, advisory or strict at every egress point |
| Personal-data controls | Built | Register, export, erasure |
| Agent, tool and approval permissions | Built | An agent borrows somebody's authority and never exceeds it |
Rules that are not configurable, and a test that says so
- ✓No agent produces a performance ratingA rating decides somebody's pay; it is a judgement a named person makes and answers for.
- ✓Nobody is recorded as having left while they can still get inExit is earned by revoked access, not declared.
- ✓An agent borrows somebody's authority and never exceeds itPermissions are re-read from the membership at the moment of every tool call.
- ✓A refusal is keptEvery tool call is logged, including the refused ones, on a table the application cannot update or delete.
- ✓A refusal is not a failureAn answer the checks refused is counted separately, and the dashboard says which check refused it.
- ✓An agent nobody has used has no scoreEvery rate is null until there is something to divide by, and renders as "—".
- ✓Anonymity lives in the schemaSurvey responses have no employee column and no key that reaches one.
- ✓Evaluation is mostly adversarialTwenty-five of thirty-five evaluation cases are answers that must be refused, each naming the check that must catch it.
Run the launch wizard with your own numbers
Bring a location, a headcount target and a budget. We draft the strategy live, watch the fifteen checks grade it, and walk the approval gate together.