Most AI tools cannot tell you why.

Three failures stop AI from being usable in regulated professional work. None of them are model-quality problems, so no amount of model upgrade fixes them.

Three mechanics, enforced by the platform.

Not guidance in a prompt. These are compiler and runtime properties, held outside the model, where a prompt injection cannot reach them.

Design it. Reuse it. Run it.

Three surfaces, one lifecycle, one versioned artefact underneath all of them — the Crew Manifest.

Six crews already in production. Every one of them is a template.

These are not demos. They are wGrow’s own production systems, rebuilt on KrewOS and published as Crew Templates you can configure.

The domain expertise ships with the platform.

A KrewOS Pack is a licensed vertical package — Crew Templates, Knowledge Packs, deterministic policies, evaluation datasets and dashboards, maintained and dated by the publisher. You are not starting with an empty canvas and a jurisdiction problem.

Your compliance team will ask. Here are the answers, before they ask.

The Trust Centre is in the primary navigation, not the footer. Procurement should not have to email anyone to start an assessment.

Four levels, one vocabulary.

The same four words are used in marketing, in the documentation, in the product and in the manifest schema. Vocabulary drift is how governance quietly stops meaning anything.

The manifest is the source of truth.

The canvas is an editor, not the source of truth. Visual edits, plain-English changes and Git commits all resolve into one versioned Crew Manifest that can be validated, diffed, exported, tested and deployed. This is what stops your AI system becoming a design file nobody can review.

Three surfaces.

Build in Studio, reuse through the Hub, operate in the Runtime. Governance is common to all three rather than bolted onto one of them.

Control Plane and Execution Plane.

Governance stays central; execution can move. That is how you get one governance model across the organisation and still satisfy a residency requirement that differs by entity.

What we deliberately do not do.

Published on purpose. A shorter list of honest limits builds more trust with a risk committee than a longer list of features.

The Template Wizard picks the starting point.

Recommendations are made against declared criteria, not vibes. The wizard shows why each candidate was ranked where it was, so a domain expert can overrule it with a reason.

Assemble Mode: the editor refuses bad structure.

Typed ports will not connect if the contracts do not match. Nested Pods collapse to one node so a twelve-agent crew stays readable. Risk, external side effects, missing permissions and estimated cost are visible on the node, not buried in a settings panel.

Describe the change. Review the diff. Then decide.

Plain-English changes never edit production. They produce a change plan, a visual diff, a validation result and a test run. You accept all, accept some, revise or reject.

Test Mode, before anyone else sees it.

Verification tiers mean something specific.

A badge is worthless unless the bar behind it is published. Here is exactly what each tier required.

Use, configure or fork.

Three modes with different upgrade behaviour and different ownership. Compatible updates may be recommended, but they are never installed silently.

Classification is the search index.

Every component is classified on the same dimensions, which is why filtering across two hundred components is useful rather than exhausting.

Human wait states are first-class workflow nodes.

Approval, missing input, exception decision and escalation are states in the graph with owners, SLAs and reassignment — not an email and a hope.

Releases, rollback and in-flight cases.

Releases are immutable, checksummed and dependency-locked. The hard part is not rolling back — it is what happens to the six matters that were mid-review when you did.

Every node run records what it actually used.

Not what the configuration said at some point. What this node, on this run, at this timestamp, resolved to.

Four deployment shapes

The same governed crew, invoked four ways. Governance is enforced by the runtime, never by the calling interface.

Evidence and abstention.

Every evidence set carries a sufficiency score against the specific claim it is asked to support. Each Crew Template declares an evidence floor. Below it, the crew returns a structured insufficiency result naming what could not be established and which sources would resolve it. It does not guess and then hedge.

Progressive autonomy.

Binary approval caps throughput at human speed forever. Unlimited autonomy is not acceptable in regulated work. KrewOS makes autonomy something a crew earns against measured evidence, and loses automatically when the evidence stops supporting it.

Declared effects, verified at compile time.

Every component declares what it reads, writes, spends and causes externally. The compiler statically proves those properties before a release exists — including that no path runs from untrusted input to an external side effect without an intervening approval gate.

Human accountability and the correction flywheel.

Every approval, rejection and edit is an immutable Correction Record tied to a named reviewer, a run, a release and a component version. Human decisions are append-only; corrections supersede, they never rewrite.

Audit and outcome economics, from the same records.

End-to-end traces from run to node to model call to retrieval to tool to approval, exportable in machine-readable form. The figures that enforce your budgets are the same figures that report your cost per outcome, so they cannot disagree.

The plane split, without the architecture diagram.

The Control Plane holds identity, catalogue, manifests, policies, evaluations and releases. The Execution Plane runs the compiled plan and holds run state. They can live in different places. That is what lets you keep one governance model and still keep your data where it must stay.

Five deployment models.

The same manifests, the same compiler, the same audit model in every one. What changes is where execution happens and who operates the infrastructure.

Residency commitments.

Stated precisely, because a vague residency claim is worse than none — it fails the first time procurement reads it carefully.

Model Context Protocol, in both directions.

n8n is a first-class adapter, not a competitor.

A crew can call a governed n8n workflow as an Action, and n8n can start a deployed crew through an authenticated API or an event. We are not rebuilding four hundred connectors, and you should be suspicious of anyone who says they have.

Bring your own key.

Platform-managed or tenant-managed credentials, held as encrypted secret references and injected at call time by the gateway.

An honest capability comparison.

“You build it” is not a criticism. A framework that shipped opinionated governance would be a worse framework. It is simply a description of who does the work and who carries the risk if it is not done.

What you would have to build yourself.

Every row above marked “you build it” is a real system with a real maintenance cost. Enumerated honestly, this is what sits between a working prototype and a crew a risk committee will sign off.

When not to use KrewOS.

If your problem is on this list, we will tell you on the call rather than after the pilot.

What most demos skip.

This replay deliberately includes the awkward parts, because they are the parts that decide whether the product is real.

By industry.

Each industry page names the production crew, the licensed Pack behind it, the controls that matter to that buyer, and measured numbers from a live deployment.

By role.

The same platform, three completely different first questions. We have stopped pretending one page answers all of them.

Not sure where you fit?

The workflow.

Seven stages, two of them deterministic and one of them a person. The deterministic stages exist because some checks must never be a model’s opinion.

What the reviewer actually sees.

The approval task is the product. Everything else exists to make this screen decidable in two minutes rather than twenty.

Built for Singapore practice.

Measured at a Singapore commercial practice.

Twelve months, one crew, one practice group. The baseline was measured before deployment by the firm, not by us.

The workflow.

Nested Pods per functional area, running in parallel where they are independent and sequencing where they are not, with exceptions routed rather than swallowed.

Controls the CFO asks about.

MAS Financial Compliance Pack.

Controls mapping, policy packs covering third-party and outsourcing considerations, reconciliation evaluation datasets and reporting dashboards — maintained with a dated currency assertion and a published update cadence.

The workflow.

Routing is dynamic because the question is not known in advance. A question about mortality after a storm and a question about feed conversion go to different specialists and hit different gates.

Why abstention matters most here.

A confident wrong answer about water chemistry kills a pond overnight. There is no review queue at 5am and no partner to catch it.

Aquaculture Operations Pack.

Three crews, in production at wGrow.

We run our own content, pipeline and tender work on these. The numbers on this page are ours, which is why we can publish them without asking a client.

A day in the queue.

What the senior editor actually does, and how long it takes. If this is unpleasant, nothing else on the site matters.

You are not trapped.

Export a complete engineering repository at any time. Not a JSON blob — a project that builds, tests and deploys.

What we own so you do not.

Each of these is a system you would otherwise build, staff and carry. The full build-versus-buy breakdown →

Extension contract and sandbox rules.

Stated plainly, because engineers respect a clear boundary more than a generous one.

Quickstart, on this page.

Twenty minutes from nothing to a governed run with a readable evidence record.

Control summary.

Scannable, because you have eleven of these to get through this week. Each row links into the Trust Centre page that carries the detail and the evidence.

What an audit actually gets.

Not a log file. A reconstructable account of a decision, scoped to the matter you asked about.

How the platform behaves when it does not know.

Most AI vendor assessments have no question for this, because no vendor has previously offered an answer. It is the section worth reading twice.

The document pack.

Click-through NDA, then immediate download. No sales call in between, and no form that routes to a queue.

A Pack is not a prompt library.

Six things ship inside every Pack, and every one of them is versioned, dependency-locked and covered by an evaluation suite before the Pack is published to entitled tenants.

Maintained Packs

A Maintained Pack is a subscription, not a download. The publisher keeps the knowledge, the policies and the evaluation suite current, and entitled tenants receive dated change notifications. Compatible updates may be recommended; they are never installed silently.

Filter the catalogue

Packs and their components are classified across fourteen dimensions. The same filters drive template recommendation inside Studio.

What is inside

Every component is versioned independently and locked to the Pack release. Forking a component keeps its lineage, and Pack updates never overwrite a fork.

The four Crew Templates

Each is a complete runnable design. You configure it; you do not assemble it.

Knowledge sources and asserted currency

Every source states its authority tier, its refresh cadence and the date the Pack last asserted it current. When a source materially changes, the artefacts that relied on it are identified and their owners notified.

Jurisdictions, languages and limits

What is inside

The most expensive Pack in the catalogue, because the tracking cadence is daily and the deterministic policy surface is the largest. Nothing in it does model arithmetic on a figure that has to reconcile.

Controls the CFO asks about

These are enforced by the runtime and the compiler, not by instructions in a prompt.

Tracked sources and asserted currency

Daily tracking is the reason this Pack exists. A circular published on Monday is classified and impact-assessed against your live crews by Tuesday, and the change notice names the components affected.

What is inside

Version 2.0.0 is a breaking release: the safety-gate policy surface was rewritten to make every recommendation carry a required-reading list, and telemetry connectors moved to the governed Action contract.