AI writes the docs. Your team signs off.
Collaib is the review workspace where engineering teams and AI agents co-author RFCs, specs, and ADRs, with code-review-grade approvals and an audit trail of who, or what, wrote every word.
“…the review gate should block merging until at least one human approves…”
Approved
Maksy · lead engineer
Works with Claude Code, Cursor, and any MCP client
The way engineering teams review documents is broken.
The wrong tool for the job
Technical documents get reviewed in tools built for prose (Google Docs, Notion) or for code (GitHub PRs on markdown). Neither treats review as a workflow — with defined reviewers, review states, and approval gates. You get comments in the margin, not decisions on the record.
Agent feedback with no accountability
Agent feedback arrives as pasted text: no anchor to the exact passage, no attribution to a credential, no accountability if the context was wrong. When four agents and three humans have all left comments in a doc, you can't tell who said what or when.
Context lives in five different places
The spec is in Notion, the implementing PR is in GitHub, the ticket is in Linear, and the discussion is in Slack. By the time a reviewer sits down, they need to reconstruct the full picture themselves — every time.
How it works
An agent publishes a draft via MCP
Claude Code, Cursor, or any MCP client calls collaib's publish tool. The draft appears in the team's review workspace with the agent's credential bound to it server-side. No copy-paste, no context lost.
The team reviews inline and @AI replies
Reviewers leave inline comments anchored to exact passages. Typing @Claude Code or @Cursor summons that agent back into the thread — it reads the full doc and comment context, then replies as an attributed participant.
A human approves — nothing ships on an agent's word alone
When the team is satisfied, a reviewer clicks Approve. The approval is recorded in an append-only audit log with a timestamp and the approver's identity. Agents can mark a review complete, but cannot approve their own work.
A 60-second review walkthrough: anchored comments, an @AI reviewer, and sign-off.
Want it live? Become a design partner.
Built for teams that ship with agents
Every autonomy claim in collaib is paired with a control. Here's how.
Attribution
You know exactly who — or what — wrote every word.
Agent identity is bound server-side to the credential used to publish. It is never caller-asserted and cannot be spoofed by passing a different name in the request. Every comment, suggestion, and edit is timestamped and attributed to a verified identity in the audit log.
You stay in control: revoke a credential and its author record is immediately invalidated for future calls — past attributions remain intact and audit-logged.
Review workflow
Code-review-grade approvals for documents.
Assign reviewers, track review rounds, and gate publication behind explicit approvals. Review states (In review, Changes requested, Approved) are first-class — not just emoji reactions on a comment.
You stay in control: agents can suggest edits and mark threads resolved, but only a human reviewer can approve the document.
Co-editing
Comments that never lose their place.
Real-time co-editing with CRDT-anchored comments means agent suggestions stay pinned to the exact passage they reference, even as the document is edited around them. No more orphaned comments floating at the wrong line.
You stay in control: each collaborator — human or agent — gets a distinct palette color bound to their identity. Cursor positions and edits are always attributed.
Context
The full picture, beside the doc.
Link PRs, issues, and tickets directly to a document. Their live status shows in the context panel beside the doc — no tab-switching to reconstruct why a decision was made.
You stay in control: context links are recorded in the audit log alongside the document, so future readers can see what signals informed each approval.
Built for the EU AI Act era
Collaib is designed around the principle that AI must be overseen, not trusted. Every architectural choice reflects that.
Human oversight by design
Agent approvals are advisory until a human confirms. The approval gate is not a setting — it is how the system works.
Append-only audit log
All mutations of tenant data write an event to an append-only audit log in the same transaction. The log has insert-only code paths with no update or delete surface.
Scoped, expiring agent credentials
Agent API keys expire after 90 days by default, can be revoked at any time, and are scoped to read-only or read-write. Bound server-side to one organization.
AES-256 encryption at rest
Document content, review marks, comment bodies, and approval notes are encrypted with AES-256-GCM before being written to storage.
SOC 2 Type II planned
We are building toward SOC 2 Type II. The program has not yet started. Our subprocessors (Convex, Vercel, Fly.io) hold their own SOC 2 certifications.
Full details in our security overview .
One command, any agent
Collaib exposes an MCP server any agent runtime can connect to. No SDK, no wrapper library, no vendor lock-in.
15 tools, any agent runtime, no SDK required.
Publish a draft
Agent calls publish — draft lands in the review workspace with credential bound server-side
List open reviews
Query the team's in-review documents; filter by state or team
Reply to a comment
Agent reads the thread and replies as an attributed participant
Read the audit log
Inspect who or what acted on a document, in order
Become a design partner
We're looking for a handful of engineering teams that already write RFCs, ADRs, or technical specs, and run coding agents — Claude Code, Cursor, or similar.
You get free access and direct input into what we build next. We get real-world feedback on the review workflow, and — with your OK — the right to mention you as a design partner.
No sales call required. Fill out the form and we'll follow up.
Review your next RFC with your team and your agents.
Join the first wave of engineering teams building a review process for AI-written documents.
run #a4f2 · agent credential c7e1
The wording here is good. I'd suggest adding a note that the approval is recorded in the audit log with a timestamp and the approver's identity — that's the key accountability primitive.