Cantilever Engineering PlatformCantilever
Zero Trust DevSecOps control plane

Amplify the tools you run.Govern every change.

Cantilever wraps your Terraform, Ansible, CI and ITSM with identity, policy and approval. Execution Guard scores every change before it runs. Nothing gets replaced.

Inbound-Zero by design: your clouds never connect into the control plane.

Get started
See a change run
  • Inventory across AWS, Azure, Google Cloud and OCI
  • Plan review before apply
  • Runs in your own cloud
Governed runs
Example
Provision · AWS SQS queueAllowed
Plan review · Azure Key VaultAwaiting approval
Execution Guard · prod changeBlocked

Certified catalog

Run what has been proven

Requesters pick from certified templates and stacks published from your Git repositories. Each certified item carries a certification date and a proven apply and destroy run across AWS, Azure, Google Cloud and OCI. Stacks chain templates in dependency waves.

Pick an item to see what it is.

Execution Guard

Every change is scored before it runs

Engineer, pipeline or AI agent, each request takes the same path. Execution Guard weighs the environment, operation, blast radius, tag compliance and threat signals, then allows the change, parks it for approval, or blocks it. A blocked run never launches.

Engineer: “Provision the AWS web + data stack from the certified catalog”

  1. Request
  2. Identity
  3. Tags
  4. Execution Guard
  5. Plan review
  6. Execute
  7. Ledger
AllowApproveBlock

Example score. Factors: Environment, Operation, Blast radius, Tag compliance, Threat signals, Standing privilege.

Pick who is asking, then run the change.

Inventory and ledger

Know what exists, and what every run changed

Collectors read AWS, Azure, Google Cloud and OCI on a schedule. The resource ledger records who ran what and what it created, so a destroy removes exactly what was applied. Drift reporting for Terraform Cloud workspaces is in preview.

  • AWS
  • Azure
  • Google Cloud
  • OCI
Resource ledger · example rows
RunRequested byResourceState
run-4812EngineerAWS web + data stackApplied
run-4809CI pipelineAzure Key VaultApplied
run-4795EngineerOCI object storageDestroyed

AI agent workflow

Agents propose. Execution Guard decides.

Ask in plain language. A supervisor routes the work to eight specialist agents grounded in your inventory, runs and catalog. They reach your tools only through the MCP gateway, and any change they draft takes the same governed path as yours.

  1. 1Supervisor reads the request and picks specialists.
  2. 2
    InventoryProvisioningDiagnosticsComplianceCI/CDITSMSecretsCatalog
  3. 3Pick a request to see who handles it.

Works with the tools you already run

AWSAzureGoogle CloudOCITerraformOpenTofuTerraform CloudAnsible AAPGitHub ActionsHarnessArgo CDJiraServiceNowAWSAzureGoogle CloudOCITerraformOpenTofuTerraform CloudAnsible AAPGitHub ActionsHarnessArgo CDJiraServiceNow

Platform

Everything around the gate

The same control plane runs the day-2 work, the guardrails and the integrations. Preview features are switched on per environment.

01Available

Command Center

Freeze changes for a tenant or hit the kill switch, and Execution Guard blocks every new run.

02Available

Managed Infrastructure

Day-2 operations on what you provisioned, through the same gate as day one.

03Preview

Tag Registry

One list of required tags. A run that is missing them is stopped before it starts.

04Preview

Claimed resources

Bring resources created outside Cantilever under governance without rebuilding them.

05Preview

Kubernetes Amplify

Govern Argo CD sync and rollback without replacing Argo. Flux and Cluster API are on the roadmap.

06Available

ITSM approvals

Approvals in Cantilever or as Jira tickets. ServiceNow request items are in preview.

07Available

Admin, SRE and Developer views

Each role lands on its own home, with permissions set by Cantilever RBAC on top of your identity provider.

08Available

Customer-managed

Run the control plane in your own cloud account or data center.

4
clouds inventoried
8
specialist agents behind one MCP gateway
7
gates on every change

Ready when you are

Govern the tools
you already run.

Bring Execution Guard, plan review and a resource ledger to your Terraform, Ansible and CI, without replacing any of them.

Get startedSee a change run
Example run · run-4812Applied

Provision the AWS web + data stack

  1. 01RequestEngineer · from the catalog
  2. 02IdentitySigned in through your IdP
  3. 03TagsAll required tags present
  4. 04Execution GuardRisk 45 · approve band
  5. 05Plan reviewApproved by a second person
  6. 06ExecuteTerraform Cloud apply
  7. 07Ledger7 resources recorded

Same path for the UI, API, pipelines and agents

  • 01Amplify, never replace
  • 02Inbound-Zero by design
  • 03AWS · Azure · Google Cloud · OCI

CantileverEngineering Platform