ESEN
Sign in

Inside

Before you trust anyone with your technology, see how they build their own.

An initiative can fail before it starts when the problem is misunderstood and planning, architecture or design is overlooked. Disconnected systems slow work, inaccurate or late information delays decisions, and bureaucracy persists when better ways of working go unrecognized. We take you inside our own system, layer by layer: what each part solves and how we keep it working.

People and agents

Your team already uses AI. They paste information into a chat, get an answer, and the context stays there.

Why it matters

When information stays in separate conversations, teams repeat work and make decisions with incomplete context. At GLab, an agent reads on a human user’s behalf and within their permissions.

Situations you may recognize

What someone learns stays in their personal chat.

  • What happens The team misses that context and has to answer the same question again.
  • How we approach it An AI agent queries the brand source and GLab Platform with the human user’s explicit authorization.

An answer relies on an outdated copy.

  • What happens The assistant uses a pasted document even though the original has since changed.
  • How we approach it Human and agent users query the same system information under the same access rules.

You don’t know what was shared, or with which assistant.

  • What happens Each user decided for themselves what company information to send.
  • How we approach it The permission links the human user, application, and organization: each connection has an identity and defined access.

In our own system

  • The human user approves the connection on a screen that identifies the application and requested access.
  • Removing their membership blocks the agent’s next request to that organization.

// context for nerds

  • OAuth 2.1 · PKCE S256 Claude Code and Codex CLI connect with browser consent and permissions delegated by the human user.
  • CIMD Application identity uses an exact, allowlisted URL.
  • RFC 8707 · RFC 9728 A credential scoped to an organization’s resource.
  • RFC 7662 Uncached introspection checks issuer, audience, validity, and read scope.
  • Streamable HTTP MCP connects agent users to tools through a dedicated credential, separate from the human user’s session.
  • readOnlyHint: true Queries require explicit authorization. The system records granted permissions and issued credentials.
  • /admin ⇄ /o/{orgSlug}/mcp Human and agent users share the same reads and access rules. A test keeps the two aligned.
  1. AI agentSends a request.
  2. /o/{orgSlug}/mcpIdentifies the organization.
  3. id.gracialab.coValidates the credential.
    • valid
    • correct organization
    • read scope
  4. MembershipChecks it is still active.Unauthorized requests are rejected.
  5. ToolReturns the query result.
Every request checks authorization again before returning a result.

One identity

One identity connects a human user’s access with the permissions they delegate to an agent.

Why it matters

Managing access for human users and agents separately adds work whenever someone joins or leaves. Authorization must follow the user across the system.

Situations you may recognize

Everyone consults AI from their own account.

  • What happens Access to information is worked out one conversation at a time.
  • How we approach it System access and delegated agent access start with the same identity.

Someone leaves, with work still in their chats.

  • What happens Information is scattered, and closing access becomes a separate task.
  • How we approach it Offboarding revokes the human user’s access and their agents’ access to the system through the same membership.

You need a file to give AI some context.

  • What happens You borrow an account because the file is outside your access.
  • How we approach it Each human user signs in with their own identity and authorizes their agent’s access.

In our own system

  • Our identity service supports Google and email sign-in, without creating a password.
  • Sensitive operations require an additional identity check.

// context for nerds

  • Better Auth ID is the sole session issuer. Platform reads sessions; the brand book verifies them with ID.
  • WebAuthn Passkeys with on-device user verification.
  • emailOTP · HMAC Email codes are bound to the browser that requested them.
  • 1 · 2_local Critical services require a GLab-verified local factor.
  • step-up ≤ 5 min Critical operations require recent verification.
Human sign-in
  • Google
  • Email
  • Passkey
id.gracialab.coSole issuer
Sessions and permissions
  • GLab Platform
  • Brand book
  • Authorized agents
One service issues identity. Human users receive sessions; agent users receive delegated authorization.

Dedicated services

A service must support decisions, data, and operations. We design it to work within the whole and evolve with the business.

Why it matters

Access, maintenance, and monitoring continue throughout a solution’s life. Automation and repeatable workflows let teams focus on moving the business forward.

Situations you may recognize

A new feature is ready to use.

  • What happens Its access, maintenance, and monitoring are still unresolved.
  • How we approach it We’re building services for access, upkeep, and monitoring, with clear rules and ownership.

A failure requires information from several systems.

  • What happens Each team checks its own alerts. Piecing events together delays the decision.
  • How we approach it We’re building a shared view of operations that connects signals and gives each decision context.

Another product needs the same brand rules.

  • What happens You assemble the brand rules and instructions all over again.
  • How we approach it One brand source aligns design and guidance for the team and its agents.

In our own system

  • Platform unites one identity, one brand source, and one map, with access by organization.
  • We’re building complex, integrated services that bring AI agents into each organization’s operations.

// context for nerds

  • SERVICE_SLUGS = ['ds', 'obs'] Design and observability define the first services we’re building for each organization.
  • /o/{orgSlug}/{service} Server-side checks for organization, membership, and enabled service.
  • 404 Other organizations and unavailable services are not disclosed.
  • CHECK (nivel_minimo in ('1', '2_local')) The database constrains allowed security levels.
  • One transaction The organization, its administrator, and service assignments are created together.

platform.gracialab.co/o/{orgSlug}/{service}

  1. oOrganization space
  2. {orgSlug}Active organization and current membership
  3. {service}Enabled service and sufficient security level
Access authorizedOutside your access: 404. Insufficient verification: verify identity.
The address connects organization and service. We’re building integrated operations on that base, with defined access and security.

Shared foundation

Shared building blocks and a clear view of how they connect help the whole system grow consistently.

Why it matters

Architecture defines what applications share and how they connect. Making those decisions visible helps teams build on what works and identify what to test when something changes.

Situations you may recognize

Your business adds another application.

  • What happens You rebuild sign-in and brand rules from the previous project.
  • How we approach it Shared identity and brand connect applications through one foundation.

A shared component needs a fix.

  • What happens You have to find which products copied it and which depend on it.
  • How we approach it Declared dependencies determine which tests a change triggers.

You need to understand how your systems fit together.

  • What happens You piece together scattered documents and ask different people how it all connects.
  • How we approach it Human users and agents can consult a system map within their permissions.

In our own system

  • Shared identity and brand keep apps consistent and bring improvements to apps that use them.
  • About 30% of the product code lives in shared packages.

// context for nerds

  • pnpm + Turborepo Tasks declare inputs, outputs, and environment variables.
  • workspace:* Shared packages expose public interfaces. Applications do not import one another.
  • catalog: One version for each shared dependency.
  • minimumReleaseAge A waiting period before adopting newly released versions.
  • turbo run --affected Selects tests from declared dependencies and task inputs.

Change to @glab/ui

  • Website
    • brand
    • config
    • mapa
    • personaje
    Does not depend on this component
  • Identity
    • auth
    • brand
    • conexion
    • config
    • db
    • email
    • env
    • mapa
    • ui
    Its tests run
  • GLab Platform
    • auth
    • brand
    • config
    • db
    • mapa
    • mcp
    • tenancy
    • ui
    Its tests run
  • Brand book
    • brand
    • config
    • mapa
    • mcp
    • personaje
    Does not depend on this component
A shared UI change triggers tests in identity and Platform, which depend on it.

Quality in every layer

A solution has to be useful and reliable. We choose tests around what could fail and what that failure would put at risk.

Why it matters

Software connects decisions, people, and data. Verifying each layer takes a strategy, from an access rule to the journey someone needs to complete.

Situations you may recognize

AI gives you code that looks right.

  • What happens The explanation is convincing. The behavior still needs to be checked.
  • How we approach it Each change triggers tests for what it affects before release.

Access permissions change.

  • What happens The new setup looks reasonable, but nobody tries accessing it without permission.
  • How we approach it We test protections by attempting the access they should prevent.

A test fails, then passes on a rerun.

  • What happens The second result is reassuring. The first failure remains unexplained.
  • How we approach it We retain and investigate failures. A passing rerun does not erase them.

In our own system

  • In our agentic factory, engineers define the architecture and design. AI agents write code under their direction and review.
  • Close to 50% of our code is tests.

// context for nerds

  • pnpm test:change Selects affected tests and journeys. Access guards require negative cases or mutation evidence.
  • pre-push Requires a complete, passing receipt for the change and a clean working tree. Also checks lint and types.
  • Playwright Journeys run against the built application. Axe checks accessibility in identity and the brand book. TESTING.md defines performance and visual stability requirements.
  1. git pushAttempts to share the change.
  2. pre-pushChecks the test receipt.
    • complete and passing
    • matches the change
    • clean working tree
    Stops without evidence.
  3. Lint and typesChecks affected code.
  4. ReviewReviews the change and its evidence.
  5. ReleaseKeeps the previous version available for rollback.
Test evidence follows the change through review and release.

What we build speaks for us.

The technology we create, and keep developing, for GLab shows what we can build.

Let’s talk about what should be possible in your business.

Take the next step