An operating system, in the original sense.
Processes, permissions, isolation and a system log, for agents instead of programs. Every guarantee below is enforced by the runtime, not by policy.
Every agent has an identity. It acts only under a grant.
A signed grant names the vault, the scopes, the operations and the time window. Grants compose across roles and across organisations, so two companies' agents cooperate on a shared task without either holding the other's data. Revocation is a signed act, honoured immediately.
Enforced
No grant, no call. The runtime checks the signature on every operation.
Recorded
Which identity, under which grant, at what time.
Verifiable
The customer holds the key that issued the grant and can revoke it.
One customer, one perimeter.
Agents execute in isolated runtimes. Inference runs on dedicated capacity per customer. Data lives in the customer's own governed cluster. Nothing multi-tenant sits between a customer's context and its agents.
Enforced
Runtime, inference and storage are provisioned per customer.
Recorded
Every call is attributed to one perimeter.
Verifiable
Hosting is a choice; the key never leaves the customer.
A signed record of everything an agent did.
Every read, write and inference call produces a signed lineage record: agent, grant, data touched, output produced. The log is exposed to the customer, not held by the operator alone. It is what lets autonomy expand without a human in every loop.
Enforced
An operation that does not produce a record does not complete.
Recorded
Agent, grant, scope, operation, output, time.
Verifiable
Records are signed and readable by the customer's auditor.
You launch agents. Nobody operates infrastructure.
Provisioning, hosting, scaling, model serving, data connectors and the agent catalog are the OS's job. Customers and partners launch agents; nobody hires a platform team to get one workflow live.
Grant, execute, record, compound.
Grant
The owner signs a scoped, time-bound grant for an operator.
Execute
Agents run in isolation, calling models behind the customer's own gateway.
Record
Every operation lands in the lineage log.
Compound
Results write back to the memory bank, so the next run starts from what the last one learned.
Model-neutral, confined at the data plane.
Tuned small open models for classify, route, extract, embed and transcribe. Larger models for reasoning. Any model behind the customer's gateway. Agent outputs stay in the vault.
The standard fixes the grant, the vault and the log.
The Agent OS is the reference implementation of SSCP, the Self-Sovereign Context Protocol. The standard fixes the grant, the vault semantics and the log. The OS adds dedicated infrastructure, the catalog and operations.