An operating system, in the original sense.
Processes, permissions, isolation, a system log and a memory, for people and agents instead of programs. Every guarantee below is enforced by the runtime, not by policy.
Every agent has an identity. It acts only through a connection.
A signed connection names the vault, the scope, what the agent may do and for how long. Roles decide who can create and remove connections, so access follows your organisation chart. Revocation is a signed act, enforced within a short, documented window.
Enforced
No connection, no access. The runtime checks it on every request.
Recorded
Which agent, through which connection, at what time.
Verifiable
Your wallet signs every connection and can disconnect any agent.
Your vault is the boundary.
Agents run in sandboxed V8 isolates, with a fresh context for every run. Data lives in the customer's own vault, partitioned into scopes, and an agent reaches only the scope its connection names. Inference runs behind the gateway, with dedicated endpoints for customers who need them.
Enforced
Each run gets a fresh isolate; each vault answers only to its connections.
Recorded
Every call is attributed to one perimeter.
Verifiable
Hosting is a choice; the key never leaves the customer.
Your workflows and know-how are your edge. Rent intelligence from a frontier lab and you hand that edge to a potential competitor. Own the stack and it stays yours.
† Attributed market estimate; not a manykind benchmark.A signed record of everything an agent did.
Every run is logged down to each model call and each data query: agent, connection, data touched, output produced. The log is exposed to the customer, not held by the platform alone. It is what lets autonomy expand without a human in every loop.
Enforced
Every run, every task, every model call has an entry.
Recorded
Agent, connection, scope, task, model, tokens, time.
Verifiable
Every run lands in the customer's run log, signed and readable. Approval gates record who signed off, and when.
You launch agents. Nobody operates infrastructure.
Provisioning, hosting, scaling, model serving, data connectors and the agent catalog are the OS's job. Customers and partners launch agents; nobody hires a platform team to get one workflow live.
Work that compounds, with lineage.
Every workflow writes what it produced back to the memory bank: the brief, each contribution, the review, the approval and the outcome. Work is grouped by goal, such as features shipped, matters per client or campaigns run, so you can follow any result from first idea to live outcome. People and agents ask it questions in plain language and get answers with sources.
Enforced
The memory bank sits inside the vault's scopes. Reading it needs the same connection as reading the data.
Recorded
Every entry links to the session, the people, the agents and the step that produced it.
Verifiable
Trace any outcome back through release, review and the first brainstorm.
Multiplayer by default.
Several people open one session on shared context. Each brings their own agent, model and skills, and everyone sees each other's contributions as they happen. Approval gates hold work until a named person signs off. Every step, branch and decision is recorded.
Enforced
Approval gates block the next step until the named role approves.
Recorded
Who contributed what, with which agent and which model.
Verifiable
Every approval is tied to one exact version.
Connect, run, log, compound.
Connect
The owner signs a scoped, time-bound connection for an agent.
Execute
Agents run in isolation, calling models behind the customer's own gateway.
Record
Every run lands in the run log.
Compound
Results land in the memory bank, so the next run, and the next person, starts from what is already known.
Model-neutral. Federate, don't replace.
Keep the assistants your team already uses. They plug in behind your gateway, and every call they make is permissioned and recorded. For sensitive work, tuned open models run on dedicated compute you control, with no dependency on a frontier lab. Tuned small models handle classify, route, extract, embed and transcribe; larger models handle reasoning. Outputs always land in your vault.
The standard fixes access, the vault and the log.
The Agent OS is the reference implementation of an open standard for owned, revocable, auditable context. The standard fixes how access is granted, the vault semantics and the log. The OS adds managed infrastructure, the catalog and day-to-day running.