Agents

The intelligence is not beside the operation. It is the operation.

An agent here is the mind’s avatar: how one mind shows up in your operation. It holds the pen, writes what the operation does, watches what that produced, and comes back with something better, carrying what it learned back to the mind behind it.

Work with us What it writes to

Author, rehearse, act, learn.

Four steps, and none is a special case for machines. This is how a person changes the operation too, which is why an agent can be trusted inside it.

Author

An agent pushes a branch in your repository: the same code and the same review path your engineers use. It joins the operation through MCP and A2A, the protocols agents already speak. The operation is plain TypeScript, not a language it has to learn from scratch.

Rehearse

The branch compiles, the acceptance specs run, and the change plays out against a twin of the operation, on the same map and the same arrivals, before it touches a machine. What passes is recorded as a digest: the hash of the exact bytes that will execute.

Act

It runs the pinned scenario through typed capability verbs: the same bytes that were rehearsed, not an intent filed for some other system to interpret.

Learn

Every choice the platform made among alternatives is a decision record, with the candidates it turned down and their scores. The next proposal comes back as a pull request, and what it took to make one returns to the mind behind the avatar.

Two runs of one scenario over the same rehearsed day against a twin: the distribution of waits at a contended gate for each run, the wait through the shift hour by hour, four checks with their verdicts, the four things the twin cannot test and who watches them live, and the promotion gate still waiting on a person — A candidate version was rehearsed against a twin on the same seed, the same map and the same 192 gate crossings, and the wait at the one contended gate fell from 8m 12s to 3m 40s. Four things the twin cannot test are listed beside it, each labelled with what would have to be watched for live, and the promote gate is still waiting on a person — the checks table and the blind spots, right panel.

Everything the platform can execute.

Not a menu of approved actions. The scenario a tenant runs is plain TypeScript carrying their world, their records and their logic, and an agent can write any of it. Narrowing what an author may express is how a system ends up able to do only what somebody imagined in advance.

Fences the platform enforces, not the prompt.

Authorship and authority are two layers. An agent may write anything; what a running scenario may actuate is decided at runtime, per verb, per resource, by the platform. Dry run and apply are a primitive. Reading and writing are separate grants. A guardrail written into a prompt is one the next model ignores, so none of ours is.

Refusals name values

When an agent is turned down it is told what was out of range and what the range was. A refusal that only says no teaches a model to try again differently rather than correctly.

One gate for every author

A person's change, an agent's change and the improvement loop's change are the same object passing the same check. Author-agnostic governance becomes a property of the substrate.

A question typed to the Planner over the Kestrel Solar operation: the eleven tool calls it made with timings, three plans scored against a stated objective with the winner and the two it beat, two refusals, one by authority and one by fence, and a live frame from a survey drone over the field with half the rows stowed flat and half still tilted on the sun — Someone asked whether a sweep can keep going in 14 m/s wind. The plan that answers it was simulated 27 seconds before the question arrived, and the card at the bottom shows the two plans it beat and the term that sank each. uav-31’s own frame, beside those plans, is the field the question is about: the south rows still being swept, the north stowed flat.

A request from a running scenario to open a quay barrier on the Harbour District operation: the six checks it has to pass with the source and age of each, the site’s own rule written as TypeScript, the authority envelope in force, a dry run with nothing actuated, and two refusals, one by site policy and one by authority — A scenario asked to open a barrier. Four of the platform’s five checks pass, the fifth is a zone read seconds past its live window, and the sixth is the site’s own rule, which holds the verb for a person acknowledged on the quay. The Planner cannot acknowledge on their behalf, and the row that refuses it names which layer said no. On the scene the dashed rectangle is the ground that rule requires empty, with p.okafor standing outside it.

What the platform had to be born with.

Intelligence at the core is not a model problem. It is six properties of the platform underneath, each brutal to retrofit onto a system designed for people to click. Every one of them is cheap on day one and close to impossible on day one thousand, which is why they are here from the start.

One call, the whole picture, honestly labelled

Every read composes the operation and says where each field came from and how stale it is.

Reading and writing are different grants

At the source, per domain. A mixed permission is how an assistant meant to look ends up acting.

Events that arrive complete

Facts, not rows, each stamped with the organisation it belongs to. An agent that notices before you ask needs a stream it can read without a second query.

Dry run and apply are a primitive

A fence in the platform, not a sentence in a prompt. What an agent may do is decided by the system.

Tenancy and consent at birth

No tenant data reaches a model without recorded, provider-scoped consent. No read crosses an organisation.

An owner and an expiry on anything long-running

An agent that works for twenty minutes is an operational object with an owner. If the owner stops answering, the lease expires and another can take over.

The operation improves itself while you watch. The mind improves everywhere.

The mind proposes the improvement through its avatar, and the proposal reaches production through the same gate every human change passes. The loop cannot edit the thing that grades it, and what grades it stays visible to you. What it learns from is your operation’s own record, which stays yours.

What leaves with the avatar is what running your operation taught it about running operations. It learns from a desensitised, abstracted model of the work: the shapes and first principles of how operations flow, never a site’s raw record. Your operational record stays in your organisation. The next avatar, on a site that has never seen ours, arrives already knowing the shape of the work.

The record of one mission on the Kestrel Solar operation: a correlated timeline across seven channels, a vendor task re-sent 61 seconds later and merged into the command it already belonged to, the Ledger answering a question with four cited records, and an export packet with its parts and a digest over the file — The Ledger was asked what happened at 11:03 and answered with four records, each one a row on the timeline beside it. A capability re-sent the same task 61 seconds later, one second outside the hatch; it was matched on the task id the capability issues itself and nothing was re-issued — the boxed block mid-timeline. The packet at the right stays open because one custody read is still contested.

A model is for judgment. Never for routing.

Classification, drafting, reading meaning out of the unstructured: that is what a model is good at, and what it does here. Deciding which machine goes through a door next is arbitration. It is deterministic, solved in code, and no language model is near it. An operation run by agents is credible only if you can see exactly where the reasoning stops and the proof starts.

Where the reflex lives