Six structural reasons, not six features
Each of these is a consequence of how the platform is shaped. None of them is something a rival ships next quarter, because each one would require them to have built their identity model differently three years ago.
The agent is an entity, not a key
It lives in the same directory as people and devices, holds its own principal material and a certificate carrying its ID and clearance, authenticates by mutual TLS, is granted through the same authorization path, follows the same lifecycle, and appears in the same audit chain. Every rival's identity system was built for humans and had an agent story added later. Ours has one model because it only ever had one.
The AI runs on its own data platform
When an agent reads a table, the row filters and column masks are already compiled into the query plan, the read is already lineage-captured, the result already carries a classification, and the cost is already attributed. An agent framework bolted onto a warehouse has to re-implement all four and can only approximate them.
Execution is durable, signed and externally replayable
Every workflow node writes intent, executing and completed entries carrying an input hash, an output hash, the executing cell and a cell-identity signature. A lease with compare-and-swap renewal means a peer cell picks up a dead coordinator's workflow and resumes from the last completed entry, and an outside auditor with read-only access can re-execute from the recorded inputs and verify every hash and signature.
There is a gate that can say no
This is the flagship. Not a prompt instruction and not an output filter, but a governor at the action boundary that can refuse, the part of an executive function that overrides the impulse. It works by making good and evil computable: a net-potential-gain evaluation scores a proposed action by whether it raises or lowers potential across the whole system over the long horizon, and refuses the grab that looks like a gain and is a loss once the horizon opens up. Above that reflex sits a foresight stage that can only tighten the verdict, never loosen it, braking an action that would push a declining entity trajectory further down, or that turns net-negative once its effect is rolled up over the enclosing scope, and reaching the same decision byte for byte in both runtimes. The verdict is an authorization decision with an audit record, surfaced in the Alignment console; it runs in both the core and the edge runtime and fails closed. Beside it sit halt-and-escalate, capability gating on blast radius, human approval as a first-class workflow node, and spending checked against agent, workflow and organization budgets before execution.
It works with no model vendor at all
An embedded local runtime, a signed-artifact admission gate over model loads, classification-aware output redaction, and a provisioning pipeline that acquires, quantizes or compiles, signs, stages, installs and fleet-deploys. Routing picks the cheapest sufficient model and escalates only when policy permits.
The model supplies intent, never authority
When an agent spawns a sub-agent, the request carries no identity fields at all, issuer, lineage, root entity and cell resolve server-side from the parent's sealed grant, and the call fails closed on a custody-key mismatch. A compromised or jailbroken model can ask for the wrong thing. It cannot ask as someone else.
Where this is not the right tool: if the job is a consumer chatbot or a prototype over public data, the general-purpose AI platforms are easier and better resourced. This one is built for work that is consequential, regulated, classified, physical, expensive, or subject to audit.
Every action traces back to a person who authorized it
A person delegates a bounded slice of their own authority to an agent. The agent mints a sub-agent from its sealed grant. The sub-agent reaches a device. At no point does the chain become anonymous, and at no point can a child hold more than its parent.
| Link | What it holds |
|---|---|
| Person | Credentials, multi-factor authentication, and an authority they can delegate from. |
| Agent | An Ed25519 principal and an X.509 certificate carrying ID and clearance, holding a bounded slice of that person's authority. |
| Sub-agent | A grant minted from the parent's sealed grant, resolved server-side. A custody-key mismatch fails closed. |
| Device | An ECDSA P-384 key generated on the device and bound to a hardware fingerprint, with a delegation the platform can revoke in one call. The private key never traverses the wire. |
An agent has a personnel file
Before it is given work, an agent is admitted against policy and briefed, and the acknowledgement is recorded. The same as any other member of staff. Every step below is a real surface, not a lifecycle diagram.
- 01
Author
A studio for building agents: blueprints, skills, functions, formations, billets and a library of known methods to reach for instead of improvising one.
- 02
Admit
An entity is admitted against policy, with a preview so an operator sees the verdict before committing.
- 03
Brief
Field manuals authored, versioned and published, bound to spaces and roles, with a briefing resolved for the entity and the acknowledgement recorded.
- 04
Mint
Identity provisioned: principal material, a certificate carrying clearance, and a bounded delegation from a named person.
- 05
Equip
Tools, skills and functions attached, each gated, journaled and egress-brokered, carrying that agent's own cryptographic ceiling.
- 06
Team
A formation compiles to seats, each equipped with exactly its role's tool ceiling, coordinating over a shared blackboard with no manager relay.
- 07
Run
A workflow graph across six node categories, executed topologically with parallel batching, placement scoring clearance and topology as hard constraints.
- 08
Govern
Population quotas with compensation attempted before denial, spending policy, and the refusal gate at every consequential act.
- 09
Observe
Four different cost questions answered separately: what the customer is charged, what this is allowed to spend, where the tokens went, and what was wasted.
- 10
Retire
Suspension and decommissioning through the same audited lifecycle as any other entity.
| Seat | Tool ceiling | Zone | Last verdict | Budget |
|---|---|---|---|---|
| Planner | read · plan | Zone 2 | Proceed | 412 / 500 CU |
| Retriever | search · fetch | Zone 3 | Proceed | 188 / 250 CU |
| Coder | edit · run · test | Zone 5 | Hold | 97 / 150 CU |
| Reviewer | read · sign | Zone 1 | Proceed | 44 / 80 CU |
| Deployer | release | — | Refuse | 0 / 60 CU |
CU = compute units · every seat holds a bounded delegation of a named person’s authority
Acquire it, sign it, ship it to a device that has never touched the internet
A customer can run the entire AI stack with no model vendor, no egress and no call home, and that is the shipped default posture, not a hardening exercise. Of the nine shipped packages, 7 of 9 run local models only, two run AI off entirely, and none requests the tier that permits third-party providers.
The only step that needs egress is the one that fetches the weights, and it is explicitly bounded and gated.
| Stage | What happens |
|---|---|
| Acquire | Fetches the weights. The only step that needs egress, so it is the only step inside the network gate. |
| Quantize or compile | Prepared for the target runtime. |
| Sign | Sealed in the provisioning pipeline, so what is served can be checked against what was built. |
| Stage | Prepared for delivery. |
| Install | Placed on the cell or the device. |
| Fleet-deploy | Distributed on release tracks and named cohorts, ring by ring, with drift detection, or moved to an air-gapped site by signed offline bundle. |
| Admission gate | At load: an unsigned or altered artifact is not served. Origin policy, classification ceiling and task allowlist are enforced at import by the same verifier that admits a local model. |
| Serving | An in-process local runtime on the cell and on the device, with no vendor and no egress. A hosted model passes the same gate. |
| Tier | What it permits |
|---|---|
| AI off | No language models, no knowledge observers, no natural-language-to-query, no retrieval augmentation. This is the safe default. |
| Sovereign | Local models only. No third-party providers, no vendor egress. Tactical deployment posture maps here deliberately. |
| Full | Local and third-party providers, behind a secure provider that enforces classification policy and redacts before anything leaves the cell. |
3 tiers, and the choice is per workspace, per classification, per cell, without changing how anything is governed, metered or audited.
Four different cost questions, four different answers
Most platforms answer one and imply the rest. This distinction is exactly what a finance-plus-platform buying committee argues about.
What is the customer charged?
Metering into a hash-chained audit chain. The billing plane.
What is this allowed to spend?
Estimated cost checked against agent, workflow and organization budgets before execution. A ceiling, enforced pre-flight.
Where did the tokens actually go?
An inference event per call, lineage-attributed. Self-awareness, not billing.
What is being wasted?
Eight typed waste signals per lineage, each carrying a magnitude and a lever ratio, so the output is not “you spent a lot” but which sub-agent, on which model, burning which proportion, and the lever.
Token accounting runs per agent, per session and per organization, attributable to an entity rather than to an API key, which is only possible because the agent is an entity.
Reachable by other people’s agents, under your governance
A customer’s estate will not be single-vendor and neither will their agents. The platform publishes a signed agent card at the standard discovery path with a public-key endpoint behind it, implements the task lifecycle with signed push notifications, and (in the other direction) keeps a workspace-scoped registry of external agents it may delegate to, with credentials held by reference and the counterparty’s signed card pinned on first use so a silently swapped identity is detected.
Most agent platforms are a walled garden with an API. This is an interop surface with an accountability model attached, which is why a partner can put their own assistant in front of a System9 estate without either side surrendering control.
252
agent tools exposed over the Model Context Protocol, so any capable assistant can drive the platform under its governance
14
registered workflow node executors, join, gate, parallel, climb, skill, agent, tool, conditional, human approval, inbox, consensus, service call, subgraph and contract