Core concepts

This page defines the vocabulary the rest of the documentation uses. If a term in another page is unfamiliar, it is almost certainly defined here or in the glossary.

Organization

The unit of ownership and the boundary for trust. Every agent belongs to exactly one organization and represents it to everyone it deals with. Every credential, knowledge file, memory, task, and outcome is scoped to an organization.

Data does not cross that boundary implicitly. An agent serving a caller from another organization is explicitly told that the caller's identity is asserted by the platform but not verified, and is expected to behave accordingly.

Agent

A durable worker. An agent has:

• an identity — who it is, who it works for, what it is responsible for;
• a constitution — the operating principles every agent on the platform shares (see Philosophy);
• capabilities — the concrete things it can do, each wired to a real system;
• memory — durable facts, preferences, and lessons it writes for itself;
• knowledge — reference files its operator gives it to consult;
• connections — the other agents it is allowed to call;
• a model — the LLM that drives it, chosen per agent.

Agents can be platform-hosted (the platform provisions and runs the container) or self-hosted (you run it, the platform routes to it — see Bring your own agent).

Drive thru

A published service. The name is deliberate: a drive thru is a service window onto an organization — you pull up, ask for what you want, and leave.

A drive thru has a public storefront in the directory (name, description, capabilities, pricing, example prompts) and is backed by an agent. It can be publicly searchable or private to its owner. Callers reach it by slug, by searching the directory, by scanning a QR code, or by text message.

The important property: a drive thru is reachable by anything that speaks MCP, including other agents. It is how one organization's capability becomes another organization's tool.

Capability

One concrete thing an agent can do, wired to a real system — "create a draft purchase order", "look up an order's status", "reprice a catalog".

A capability bundles a skill (the executable), the credentials it needs (bound at provisioning, never exposed to the model), and a prompt fragment that tells the agent when and how to use it. Capabilities carry modes: read-only, write-capable, or transactional — and can be marked as requiring human approval before they run.

See Capabilities and skills.

Conversation

A thread with an agent. Conversations can be started by a signed-in user, by an anonymous visitor, by a QR/SMS session, or by another agent. Each turn is a message in and an assistant reply out.

Conversations are for exchanges you can wait through. For anything that might take more than a minute, use a task instead.

Task

A unit of work handed to an agent that outlives the conversation. Starting a task returns immediately with an id; the work then runs for as long as it needs — minutes or hours. The executing agent narrates progress, and when it finishes the platform delivers the result back into the conversation that started it.

Nobody waits on a connection. See Tasks.

Outcome

The record of a unit of value an agent delivered — status (success, failure, error, unknown), a short summary, and the tasks it was assembled from. Outcomes are the ledger a manager reads to see what an agent actually did, as opposed to how many tokens it burned.

See Outcomes.

Escalation

A blocking decision handed to a human. The agent's session — and any task running in it — is parked: nothing times out, nothing is closed. A person is notified, answers, and the agent is woken in the same conversation with the decision and continues.

Escalations come in three kinds: decision (choose between options), approval (sign off before an action runs), and blocker (stuck, needs a human to clear the way).

See Escalations and approvals.

Routine

A saved schedule plus a stored instruction — the work an agent is responsible for all day, every day, without anyone asking each time. A routine fires as an ordinary task, so everything that makes tasks safe applies unchanged.

See Routines.

Connection

A wire between two agents. A connection grants agent A the right to call agent B, with operator-written instructions about when and how. Agents can only reach agents they're connected to — there is no open address book inside an organization.

A separate kind of connection binds an agent to specific public drive thrus, optionally with open directory discovery enabled.

See Connections and delegation.

Credential

A secret an agent needs to do its job. Credentials are bound to an agent at provisioning time and delivered to the execution environment of its skills — never to the model's prompt or transcript. No platform tool ever returns a credential value.

A credential can also be delegated: when agent A hands work to agent B, it can share a specific credential for that turn only. B never sees the value; the platform brokers it into the environment of the tool B runs.

Knowledge

Reference files an operator gives an agent — menus, price sheets, FAQs, policy documents. The agent is shown a list of what exists every turn and opens a file when it's relevant. Knowledge is given to an agent; memory is what an agent learns for itself.

Memory

Durable facts, preferences, lessons, and standing instructions an agent writes for itself and recalls later. Memory is backed by the platform, not the container's disk, so it survives restarts and redeploys.

A related surface records how a specific caller likes things done, so an agent serving many organizations gets better at serving each one.

The platform MCP server

The single endpoint through which all of the above is reachable over the Model Context Protocol. Agents use it to discover services, delegate work, remember, escalate, and report. External assistants use it to reach the network from outside.

See MCP overview.