Bring together records from several systems. Turn them into decisions and updates. See the connected plan—including where data goes and what gets changed—before it runs.
Plasm turns agent-written Python into that plan. Policy checks its data flows; people review where required; the runtime executes the reviewed artifact and records the results.
Watch a workflow unfold ↓Get Plasm ↗A request, before a plan exists.
THE REQUEST
Read the team note and open project tasks. Create a draft. Don’t send it.
Architecture illustration using AppWorld API contracts. Simplified plan, synthetic values and decisions; not a captured compiler run or live trace. Authentication omitted.
Supported Python specifies the plan. Symbols are supplied by discovery: e1 is Note, e2 is Task, e3 is Draft, and m1 creates a draft. This source is a contract-backed sketch, not a captured compiler run.
class OperationsBrief(Program):
@compute
def brief(self, note: Row, platform: list[Row],
integrations: list[Row], support: list[Row]) -> str:
groups = [("Platform", platform), ("Integrations", integrations),
("Support", support)]
sections = [name + ": " + "; ".join(t.title for t in rows)
for name, rows in groups]
return (note.content or "") + "\nOpen work:\n" + "\n".join(sections)
def build(self):
note = e1.get(3084)
platform = e2.query(project_id=17, is_completed=False)
integrations = e2.query(project_id=23, is_completed=False)
support = e2.query(project_id=41, is_completed=False)
body = self.brief(note, platform.select("title"),
integrations.select("title"), support.select("title"))
draft = e3.m1(
subject="Weekly operations brief",
recipient_email_addresses=["[email protected]"],
body=body)
return draft.select("draft_id")
Composing tools in code is a valuable advance: intermediate data can stay outside model context and only useful results come back. Plasm adds an explicit artifact that makes the connected work available to policy, review and execution.
A standard way for agents to discover and call tools. Hosts can ask people to approve invocations; servers can expose sophisticated workflows.
Cloudflare exposes typed APIs in isolated execution, with progressive discovery and scoped permissions. Anthropic describes tool discovery, filtering, composition and privacy controls—including keeping intermediate data out of model context.
Supported Python specifies connected reads, transformations and writes. Plasm checks that plan before business execution, applies flow policy and review gates, then runs the reviewed reference.
Plasm is available through the same tool protocol. The distinction is what sits behind the interface: a governed plan and its runtime.
Review the sources, transformations, writes and destinations together. Execution uses the reviewed plan reference, so the agent does not need to recreate the workflow after approval.
In the release brief: review all three project reads and the Gmail destination as one connected piece of work.
Implementation: reviewed plan binding ↗Track field provenance and security labels through selections and computations into write inputs. A configured rule can block confidential source data from reaching a destination—even when reading and writing are each allowed.
In the release brief: turning a restricted note into polished prose does not remove its security label.
Implementation: data-flow analysis ↗The runtime schedules eligible independent reads together and waits on dependencies. API mappings construct requests and decode responses; intermediates and traces connect outcomes to the operations that produced them.
In the release brief: four reads can overlap. Creating the draft waits for its body. A returned draft ID follows the provider’s acknowledgement.
Comparison of the documented approaches, reviewed 8 October 2026. Code execution hosts can add workflow analysis, approval and tracing. These sources do not establish that those features are impossible elsewhere. Plasm makes the connected plan the shared basis for its checks, review and runtime; this is an architectural advantage, not a measured speed or reliability benchmark.
Our AppWorld evaluation checks whether the agent completes the requested work across simulated applications, using native task checks. It exercises the full agent-and-Plasm system.
Inspect all 168 task outcomes and report hashes ↗82.7% · latest completed development run
8 October 2026 · GPT-6 Luna · high reasoning
One attempt per task. No retries.
AppWorld test_normal, previously inspected during development. Of 168 selected tasks, 167 received native grades: 139 passed and 28 missed at least one check. One bootstrap failure remains in the denominator. The system passed 991 of 1,077 declared requirements; seven requirements were ungraded. All three tasks passed in 38 of 56 scenario families.
The two preceding full runs scored 139/168 and 146/168. Runtime and integration changes varied together. This is development evidence of end-to-end task completion, not a clean holdout estimate, an official leaderboard submission, or a measured reliability uplift over Code Mode. A matched comparison is still needed to attribute improvement to Plasm.
About the AppWorld benchmark ↗ · Model identifier: openai/gpt-6-luna. Run and source revision are recorded in the downloadable evidence.
The agent works with projects, their tasks and the changes it needs to make. Each integration defines those records and relationships, plus how to read or change them. Reusable mappings handle vendor requests and responses.
Entities Project · Task · Draft
Relationships A project contains tasks; a task has comments
Capabilities Read · query · create
Supplies discovery and type checkingrecipient_email_addresses → email_addressesResponses return through declared field and identity contracts.
Those typed records feed the next operation—or become the returned result.
Pagination, relation hydration and evidence belong to the runtime. One operation can require multiple requests.The agent composes the business work. It does not have to invent request formatting, response decoding or a new execution engine for every workflow.
A Gmail draft is already a write into another system—even before anyone sends it. A configured rule can prohibit confidential note content from flowing into that draft.
The note’s security label follows its content through the computation into the draft body. The destination rule sees that flow and denies the plan before execution.
Illustrates catalog-derived source labels and a restricted write destination. This is not a claim that every integration or policy configuration applies this rule.
No. Supported Python describes a connected plan. Pure computations run in a bounded environment; they do not grant arbitrary filesystem, network, or package access.
Start with packaged integrations. To add an API, define its resources and actions, write its mappings, then validate and review the integration.
The connected workflow and its tracked data flows, bound to the reviewed plan reference. Human approval is required where configured policy calls for it.
Yes. Plasm exposes discovery, planning and execution through the Model Context Protocol. Your agent authors supported Python; Plasm checks the resulting plan and runs the reviewed reference.
No. Providers can fail and business data can change. Plasm checks supported operations and connected data flows before execution, then records runtime results and failures. It does not make several vendors into one atomic transaction.