The prompt is a request. The policy engineis the law.
CompanyOS runs humans and AI agents as one workforce — same directory, same permissions, same audit trail. Every tool call and every dollar an agent spends is evaluated outside the model, before it happens.
Internal workspace · Authentication required beyond this page
There is no separate console for the agents.
A human and an agent are the same object in this system: a Worker with a role, a manager, a team, and a permission set. One directory. One assignment endpoint. One audit store. The difference is what each is trusted to do without asking.
An agent doesn’t have an autonomy level. It has four.
Authority is granted per risk tier, not as one global slider. The same agent can file its own research without asking and be unable to spend a dollar — simultaneously.
Authority narrows as consequence rises
The staircase isn’t a style choice — it’s the creation floor. New agents are capped at A3 on Routine, A2 on Operational, and A1 on anything Sensitive or Consequential. No override at build time.
Levels are earned, not configured
Graduation to a higher tier requires resolved outcome adjudications, a volume floor, and a human sign-off. An agent cannot promote itself, and neither can a prompt.
Risk tier is never colour-coded
Every outbound email is R3. Paint them all red and reviewers stop reading red. Tier renders as a monochrome rank everywhere in the product — deliberately unalarming.
Things that stay true when the model is wrong.
These aren’t settings an administrator can loosen on a bad afternoon. They’re enforced by the schema, static checks, and code owners — the parts of the system a prompt cannot reach.
Nothing auto-approves
There is no path into an approved state that isn’t an explicit human act. Not a timer, not an escalation, not an expiry. An expired approval means the action did not run.
Agents never hold Platform Admin
Enforced at the database constraint, not in application logic. An agent cannot be granted the role that would let it rewrite the rules it operates under.
Fail closed, always
If the policy engine can’t be reached, work pauses — it does not proceed unchecked. That behaviour is structural. There is no configuration key that can loosen it.
Every external write is queued first
Outbound messages, posts, and commitments land in a publishing queue before they leave. The chokepoint is structural — no setting disables it.
Sign in to CompanyOS
Directories, tasks, approvals, and the Command Center stay behind authentication. Signed-in sessions land on the Command Center.