Skip to the content
Agent FactoryProvided byAgent FactoryProvided by
LearnSign in

Agents at Dubai speed. Under Dubai rules.

Agent Factory is where DDA picks AI agents from a signed Library, runs them where it chooses, and governs every model call and tool call they make.

Sign inSee how it works
Three arched gateways in a white plaster wall, the middle one opening onto clear cyan.

How it works

From a signed package to an agent that is governed and metered on every call.

  1. A white plaster wall with a grid of niches holding navy cubes, one cube cyan and one niche empty.

    Pick from the Library

    CYBERAIQ AG publishes each agent as a signed package: its images, its MCP servers and tools, the connectors it brings and the model it needs. Agent Factory checks the signature and will not deploy a package that fails it.

    Read about the life of an agent
  2. Three arches of different sizes in a white wall, each with a white cube waiting in front of it.

    Deploy it anywhere

    Run it on AKS or any Kubernetes cluster, on a host with Docker, or on a workstation. Each agent gets its own key and a bundle to start with, and reaches its model and its tools only through Agent Factory.

    Read how one call flows
  3. A line of cyan cubes leads through a navy arch, while one orange cube is held aside on a plinth.

    Govern it from one place

    Block a model, an MCP server, a tool, a connector or an API tool. Turn on read only mode, set a monthly budget, suspend an agent. Every refusal is recorded with its reason.

    Read about governance
  4. Six plaster blocks rise like a bar chart against a white wall, the tallest one navy.

    See what it costs

    Models come through Agent Factory's own gateway: Azure AI Foundry today, DDA's own GPUs when they are ready. Every model call carries its tokens and its cost, so spend shows per agent, per model and per call.

    Read about cost

When Agent Factory says no

Agent Factory answers a refused tool call itself, and the call never reaches the tool server. The agent gets an ordinary tool result, and both agents show it to the person as it stands, without retrying.

Firewall Management Agenttools/call add_address_to_group
{"jsonrpc": "2.0","id": 1,"result": {"content": [{"type": "text","text": "Blocked by Agent Factory: read only mode is on, and add_address_to_group can change things."}],"isError": true}}
Recorded as blocked, with the reasonread_only_mode
Read only mode is on, so every tool that can change something is refused, for every agent.

What stays with DDA

  • Prompts and answers pass through Agent Factory. They are never stored.
  • Keys are kept as hashes. Provider and tool keys are encrypted with a key that is not in the database.
  • Every model call and tool call is recorded. Every change and sign in goes to an audit trail that no API can change.
  • A block holds from the next call. A suspended agent is refused within 10 seconds.
  • An agent reaches only the models, servers and tools it was granted. Confidential and secret agents use models hosted on premises.
  • No telemetry and no update checks. With models and tools on premises and local sign in, nothing leaves DDA’s network.

The first two agents

Both are in the Library, signed by CYBERAIQ AG, with their own interface and their own tools.

  • Firewall Management Agent

    Answers questions about the FortiGate rule base, reviews access requests, keeps the rules clean and the firmware patched, and changes the firewall only through a change a person approved.

  • Network Device Lifecycle Agent

    Finds network devices near or past end of life or exposed to known exploited vulnerabilities, and keeps their CMDB records right through changes a person approved.

Read about the two agents

Works with

Azure AI Foundry
gpt-5.4-mini today, reached with Microsoft Entra ID or an API key.
DDA’s own GPUs
Any OpenAI compatible server, hosted on premises.
AKS
The reference cluster. Any Kubernetes cluster with NetworkPolicy support works.
Docker
Docker Compose on one Linux host, for Agent Factory and for each agent.
MCP
Tool servers over streamable HTTP, called through the MCP gateway.
Microsoft Entra ID
Sign in for people. The app role sets each person’s role.

Your agents. Your rules. One factory.

Sign inLearn how Agent Factory works