WRITING / 12 JULY 2026

How Darkmatter's first governance project became a nightmare

Building Command Center: agent governance, access control, and security in the age of Mythos.

Command Center is our internal registry and access-control layer. It holds project context, permissions, resource mappings, and references to where secrets live. It also brokers secret reads. Every Darkmatter project and agent uses that context to find the right repository, Linear team, database, deployment project, analytics property, or skill. How do you keep such a useful product safe?

I built it to onboard agents across 27 projects and 151 connected resources. By July 2026, it had logged 2,008 CLI runs and 979 audited secret-reference accesses.

At one of our busiest points, rotating between multiple clients and the projects inside each one, we found that a handoff was rarely as simple as adding someone to the right GitHub project. Their agent had no context. The human had no idea where the database was. The same questions came up time and time again. Let's not even get started on managing secrets.

What if we had a platform that could gather all the context required for a product? It could also show what had happened that week (our PM would thank us), product analytics, costs (our CEO would too), and centralised access at the environment or project level (our clients would pay well for this).

The first version sat behind Google Workspace sign-in and included a CLI. Then came the question: "What if we could use this to recognise an agent or user and give it access to secrets? How quickly could they get set up?" I'm pretty sure it still felt more like "maybe I can build it" at this point, but by the time I stopped, it was deployed.

Then the warnings kept getting louder. In November 2025, npm was hit by Shai-Hulud 2.0, which stole credentials as it burrowed through libraries. In April 2026, Anthropic published Claude Mythos Preview, describing a model that could find and exploit zero-day vulnerabilities across major operating systems and browsers. My chest started feeling tight. Maybe this decision was heading in the wrong direction.

"It's only a matter of time before anyone gets hacked. We need to keep the impact as contained as possible," became the informal motto. "What do we do with Command Center?"

Cutting a long story short, here's what we decided and why:

GitHub still needed to send push and pull-request events. Linear still needed to send webhooks. Health monitors and agent callbacks still needed a destination. A private control plane with no public application port cannot receive a POST from a public service.

Opening another inbound route would have recreated the boundary we had just removed. So we inverted it.

A mailbox outside the wall

Outpost is the small public component that remains. It runs on Vercel and accepts four kinds of events: GitHub, Linear, health, and agent callbacks. The first three use HMAC signatures. Agent callbacks use a bearer token.

Think of it as a mailbox. Public systems drop authenticated bytes into it. Outpost verifies the sender, stores the event in a durable queue, and waits. The mailbox has no idea it's standing right outside the house (Command Center).

Command Center initiates the connection. A worker on the private host opens an authenticated long poll to Outpost, claims a batch of queued events, and pulls them across the boundary.

Outpost's first check protects the public receiver. Command Center repeats the signature check after the pull, so the private control plane does not treat the relay as an authority.