A change can skip important checks
Required details, dependencies, or review steps sit outside the workflow that moves the change toward release.
Security-critical operations
Keep restricted work and its review steps in one controlled environment.
Teams can manage change workflows, dependencies, procedures, and AI proposals in a self-hosted or fully air-gapped TOW deployment.
Common problems
A restricted network still needs a clear process for change and review.
Teams need to see the required review steps, the technical details behind a change, and how generated output is approved.
Procedures and technical work drift apart
The dependency map, implementation record, and operating procedure no longer describe the same work.
AI output is hard to verify
A generated answer has no visible sources, or a proposed change has no clear review step.
In TOW
How teams can manage work in a restricted environment.
These examples cover controlled work records. They do not provide continuous security monitoring or replace your organisation’s assurance process.
Put review steps into the change workflow
Add peer review and a release gate between authorised work and release, with blocked and withdrawn paths in the same workflow.
- Path from draft to authorised
- Peer review and release gate
- Blocked, withdrawn, and released outcomes
Link recovery procedures to changes
Keep backlinks, references, and related change records on the procedure so responders can find the right information together.
- Recovery procedure details
- References and backlinks
- Related changes
Review AI proposals before applying them
Show the target, reason, and proposed change in the review queue, with controls to accept or reject it.
- Target and reason
- Proposed workspace change
- Accept or reject controls
Before deployment
Review deployment, access, AI, and approval settings separately.
TOW can run in a fully air-gapped Docker Compose environment when every dependency stays inside it. Your organisation remains responsible for architecture, hardening, monitoring, recovery, and operational assurance.
Run TOW in an isolated environment
Keep the application and its dependencies inside infrastructure your organisation controls.
Set project and document access
Search and AI only use sources the person is allowed to access.
Choose how AI is used
Configure or disable the provider and decide which supported workflows require review.
FAQ
Questions worth answering clearly.
Current product, deployment, and commercial boundaries.
Can TOW operate with no external network access?
Yes. TOW can run as a fully air-gapped Docker Compose deployment when the application and every dependency, including any AI provider, stay inside the isolated environment.
Does TOW provide continuous security or incident monitoring?
No. TOW provides administration and work-management features. Infrastructure and security monitoring remain part of your own operating environment.
Can AI be disabled or kept behind human review?
Yes. Administrators can disable or configure the organisation AI provider. Supported proposal flows have accept and reject controls, while any direct-write agent workflows must be enabled separately.
See TOW in your environment