Know what your
agents did.Prove it.

“What did your AI do on my account?”

Maybe you run four companies. Or six clients. Or fifty. Your agents touch their data every day: drafting, sending, filing, deciding. Then a client asks what happened, and all you can hand them is a scroll of chat history that proves nothing.

• → An agent touched client data. Nobody approved it, and nothing was logged.
• → The rules live somewhere in a prompt, so nobody can point to them, let alone enforce them.
• → The proof you'd need is scattered across four tools and three chat windows.

Thornbury Ledger isn't a chatbot, a router or a platform. If a feature doesn't get more useful as you take on more clients, we don't build it.

The authority matrix, live.

This is what the product actually looks like, and how we run our own team of agents. Click any cell to change what that agent is allowed to do. Every change writes a tamper-evident, hash-chained record.

Click cycles: allow → gate → deny. Keyboard accessible.

Demonstration hash chain, computed in your browser. Nothing on this page is transmitted anywhere.

We price by how many clients you run, not how big you are.

A context is anything with its own login, data and rules: one client, one company, one brand. Drag the slider and find where you land.

We never hold your provider keys. At any tier.

Not a policy we could quietly change: an architecture. Watch where the key actually goes.

Before the first paid customer: encryption at rest, per-tenant isolation at the query layer, a published data-handling page, a documented deletion path. Not SOC 2: that comes when a deal requires it, and we will say so plainly rather than imply otherwise.

One question kills most roadmap requests.

Does this get more useful as you take on more clients? If not, the answer is no, full stop, logged and returned with thanks. Try it with a feature you actually want.

Services now. Product next. In that order, on purpose.

The services we sell today aren't a placeholder while we build the product. They fund it and shape the roadmap: every paying customer helps write the spec.

Honest timeline to usable alpha: 4–7 months, wide bars, planned against the top of that range. Built as a fork of LibreChat, we build the governance layer, not another platform. AGPL from the first commit.

The free tier isn't crippled. That's the point.

Full governance, free: the matrix, the gates, the decision records. We charge for extra depth and the managed version, never for the ability to prove what happened.

A source-available AGPL self-host arrives around month 9–12, deliberately unmarketed: public repo, README, no support, no SLA. Self-hosting stays free: anyone offering Ledger as a service has to open their changes.