Company
We started with the systems nobody else could reach.
HBX came out of access to legacy telco and industrial systems that were never built to let anyone in. The agent layer came after.
Where we come from
The hardest systems came first, agents second.
HBX was born out of access to legacy systems in telco and industry: the switch rooms, the control networks, the platforms that predate modern sign-in standards by decades. Getting an authorized person inside one of those, provably and reversibly, is not a problem you solve from a cloud console. We solved it there first. Everything since has been built on that.
Systems that don't speak HTTP
Technology older than modern sign-in, on networks that aren't yours, in front of equipment nobody restarts during production hours. That is where you learn what access actually costs.
Cloud-first vendors never met a system that can't be patched
Most of it began at a cloud API and wrote an agent story on top. Nothing on that path ever forces you to meet a system that can't be patched, migrated, or asked nicely to support modern sign-in.
Legacy reach is not a roadmap item
It is where the company came from. Temporary access, limited to one system and cut off on demand: those existed before there was an agent to point them at. We don't have to go build them for you.
Why it matters now
Agents stopped answering and started acting.
The moment an agent starts changing things, the question stops being what it saw and becomes what it was allowed to do: delete data, change production, move money. That is the question we had already been answering for people, in the least forgiving environments there are. The actor in the seat changed. The problem did not. Which is why the control was being built before the industry noticed it needed one.
Already commoditized
Read-only visibility into what an agent looked at. A read-only login covers most of it today, and everyone ships one.
Still unanswered
Destructive actions on systems that don't speak modern sign-in, across company boundaries, with no approval at the moment of the action and no clean way to cut access mid-task.
What's built
Every company will put agents on its core systems. None of those systems can tell who is logging in.
Human Access and Agent Access are not two builds that happen to share a logo. They are the same delegation core: limited, expiring access that can be cut off at any time, into a system that was never designed to grant it. What differs is who sits in the seat, not how the access is governed. That is not packaging. It is what you end up with when the access problem, and not the agent wave, is the thing you built for.
One delegation core
Same access model, same rules, same audit trail, whether the actor is a person or an agent acting on that person's authority. Nothing about the hard part gets rewritten per product.
Standards, not a private protocol
The implementation is built on open sign-in and delegation standards: OpenID Connect, ID-JAG and Cross-App Access. HBX has run and filed interoperability tests in the OpenID Foundation's AIIM interop event; the results are the Foundation's to publish.
Talk to the people who built HBX.
Thirty minutes. Bring the system everyone else called out of scope.