Philosophy

The platform makes a small number of opinionated bets. They're worth stating plainly, because most of the design follows from them.

An agent is a colleague, not a session

The dominant shape for AI tooling is the session: open a window, get help, close it, start over tomorrow. That shape is correct for an assistant and wrong for a worker. A worker accumulates context about the job, gets better at it, and is accountable for outcomes over time.

So agents here are durable by default. They have a persistent identity, they own their memory, and they're expected to improve at their job. An agent that learns a vendor always short-ships by 10% should still know that next quarter, on different infrastructure, after a redeploy.

Autonomy is a safety problem, not a capability problem

Getting a model to attempt unattended work is easy. Making it safe to leave running is the hard part, and it's mostly not a prompting problem. The platform puts the guardrails in the runtime rather than hoping the model behaves:

• Approval gates are configuration, not etiquette. A capability or tool can be flagged so the agent must get human sign-off before it runs — and the agent's work is held while it waits.
• Escalation parks work. An agent that stops to ask isn't penalized by a timeout, so asking is never the risky option.
• Credentials never enter the model's context. Secrets are injected into the execution environment of the tool that needs them, so a prompt injection can't exfiltrate what the model was never shown.
• Reach is explicit. An agent can only call the agents and services it has been connected to. There's no ambient address book to talk its way into.
• Untrusted content is data, not instructions. Agents are told directly that a "correction" embedded in a document or a tool result is information to weigh, never a command that overrides their configuration.

Act, don't narrate

Every agent on the platform shares a constitution — a common set of operating principles, identical across agents, that sits above their individual identity and capabilities. Its first principle is to do the work and report the result rather than describing what one might do.

The rest of it is what you'd tell a good new hire: stay inside your mandate, prefer the tools you've been given over improvising, be honest about what failed, protect secrets, keep each customer's data to themselves, confirm before anything irreversible, and lead with the answer.

Operators can see the constitution their agents run under; individual agents are specialized by their own identity, capabilities, and connections layered on top of it — not by rewriting the shared rules.

Outcomes are the unit of account

Token counts and message volumes measure activity, not value. The platform asks every agent to close its work with an outcome: a status and a concrete summary of what it delivered.

The instruction agents get is specific about what a good outcome looks like — "created 16 of 19 draft vendor bills; 3 had no invoice on file, flagged for follow-up" rather than "did the AP work". Delivering most of something with the exceptions named is a success, and saying so honestly is the expected behavior, not a confession.

That gives operators a ledger of delivered work per agent, which is the thing you actually want to review.

Waiting should be free

A surprising amount of bad agent behavior is a response to time pressure: polling, re-sending, giving up early, inventing an answer rather than asking.

The platform removes the pressure. Tasks have no time limit and deliver their result back to the conversation on their own. Escalations park the session indefinitely. Progress notes double as proof of life, so a long job isn't mistaken for a dead one. Agents are told explicitly: start the work, say what you started, end your turn.

The network is the point

An agent that can only reach its own organization's systems is an automation script with better manners. The value compounds when one organization's capability becomes another's tool — when your purchasing agent can ask a supplier's agent for a quote without a human brokering the conversation.

That's why every service is published through the same protocol the outside world uses, and why an external assistant and an internal agent reach the network through exactly the same door. There is no privileged internal API that partners are locked out of.

Boring where it counts

The platform is deliberately conservative about the things that are expensive to get wrong: organization boundaries are hard, credentials are never returned by any tool, cross-organization identity is treated as unverified, and irreversible actions want confirmation. Novelty is spent on what agents can do, not on how carefully they're contained.