Agent Platform
The Agent Platform is where the intelligence actually does work.
An agent here is not a process holding an API key. It is a directory entity with its own cryptographic identity, and that single fact is what makes the system distributed rather than merely multi-instance: the same identity executes wherever it needs to, in any cell, inside a clean room, out on a device at the end of a radio link, and everything it does there resolves back to one principal, one record, and one growing picture.
One identity, executing everywhere
This is the structural idea, and everything else on this page is a consequence of it.
A conventional agent framework gives each deployment its own credentials, its own memory and its own log. Ten deployments produce ten disconnected workers whose output has to be reconciled afterwards, if anyone bothers.
System9 puts the agent in the same directory as people, devices, nodes and organizations. So:
- Authority travels with the identity. An agent authorized once can act in any cell that identity reaches, under a delegation that can only narrow. There is no second credential to provision at each site.
- Work is attributed to the principal, not the process. A run in a plant cell and a run in the core resolve to the same agent, so its record, its cost and its behaviour are one series rather than ten.
- Every result is addressable by the whole. Local work rolls up: a workspace has a mind, a clean room has a mind, a cell rolls into its node, and a node rolls across the organization.
- Reach compounds. Each new place the identity can execute is not another silo to reconcile. It is another region of the same intelligence, and what it learns there is available to the rest.
That is what "distributed" means here. Not agents running in many places. One intelligence, incrementally built, that happens to execute in many places.
Start here
| Page | What you get |
|---|---|
| Concepts | Why an agent is an entity rather than a key, and what that changes |
| The life of an agent | The full arc: author, admit, mint, equip, brief, team, run, coordinate, govern, observe, pay, retire |
| Delegation and authority | The person to agent to sub-agent to device chain, and why authority can only narrow |
Running work
| Area | What you'll find |
|---|---|
| Agent runtime | Durable, signed, externally replayable execution |
| Agent jobs | Submitting work as a durable, governed job: admission that can refuse before anything runs, a guarded lifecycle, and signed job requests between entities |
| Sub-agents and the sandbox | How an agent spawns workers, the isolation they run in, the gate that decides whether a spawn is worth it, and live supervision |
| Orchestration & agent teams | The workflow graph, crews, formations, billets, and the blackboard agents coordinate over |
| Agent teams | Skills, blueprints, billets and formations: how a team is specified, validated and compiled into a run |
| Coordination and shared state | The blackboard, task claiming with exactly-once semantics, locks and leases, and how a team spills work upward |
| Tools & MCP | The tool catalog, the governed shell surface, and the Model Context Protocol server |
| How an agent finds a tool | Belt, box and shed: progressive disclosure over hundreds of tools, without widening authority |
| Agent skills | Packaged, reusable capabilities an agent invokes, authored and governed like any other asset |
| The Algorithm Library | Identify, select, execute: a governed decision table over executable algorithms, with distributed execution |
| Knowledge & semantics | Ontology to canonical entity to a federated semantic manifold that exchanges signed projections rather than raw vectors |
Models and surfaces
| Area | What you'll find |
|---|---|
| Models & sovereign AI | The production pipeline with one gated egress step, the three tiers whose default is AI off, the two runtimes, model operations as a SQL surface, and AI and model security |
| Chat | Conversation as a governed, workspace- and clean-room-scoped surface, where the assistant cannot see what the asker cannot see |
| Agents as a service | Serving your agents to other organizations and reaching theirs: a signed agent card, four ways to authenticate an inbound caller, and pinned peer cards on the way out |
| Provisioning through conversation | Asking for a database, a bucket, a topic or a clean room, and the approval path that request passes through |
| Prove-It | A signed verification bundle over an answer, proving no classification marking was bypassed |
| Chat on core and edge | One conversational contract held by two runtimes, pinned by parity fixtures, and what a disconnected device refuses |
| Studio | The authoring console: skills, blueprints, agents, teams, functions, field manuals and the crew monitor |
| Compute substrate | One sandbox, one metering path, one audit trail, shared by an analyst's notebook, an engineer's coding run, and an agent's sub-task |
| Software engineering | The governed coding agent, signed diff receipts, the fail-closed pre-commit scan, source control, and the same loop running disconnected |
Governing it
| Area | What you'll find |
|---|---|
| Agent governance | Population quotas, spending budgets, and decisions taken by encrypted ballot rather than by an administrator |
| Entity contracts | The signed, bilateral agreement that binds one principal to another, and narrows what an agent may touch |
| Agent economics | Token and inference transparency, metered compute units, four layers of budget, and how a sub-agent's spend rolls up to its parent |
| Observing an agent | Transcripts, the lineage tree, spend per sub-agent, and what an agent can see about itself |
| Alignment | The open substrate-alignment standard, the net-potential-gain gate, the foresight composer, and the substrate primitives |
Why it is built this way
Each of these is a consequence of the architecture rather than a feature to be matched next quarter.
- The agent is an entity, not a key. It holds its own principal material and a certificate carrying its ID and clearance, authenticates by mutual TLS, and appears in the same audit chain as a person.
- It runs on its own data platform. When an agent reads a table, the filters, masks, lineage, classification and cost attribution are already there. A framework bolted onto a warehouse has to re-implement all four and can only approximate them.
- Execution is durable, signed and externally replayable. Every workflow node writes journal entries carrying an input hash, an output hash, the executing cell and a cell-identity signature. A peer cell resumes a dead coordinator's workflow from the last completed entry, and an outside auditor can re-execute the run and verify every hash.
- There is a gate that can say no, at the action boundary rather than in the prompt. This is an authorization decision with an audit record, not a prompt instruction or an output filter.
- The model supplies intent and can never supply authority. A spawn request carries no identity fields at all: issuer, lineage, root entity and cell are resolved server-side from the parent's sealed grant, and the call fails closed on a custody-key mismatch.
- Surface is not authority. What an agent can see in its tool list and what it is permitted to invoke are separate, deliberately. Widening one never widens the other.
- The platform governs how many agents exist. Creation, instantiation and spawning each pass a quota gate, spawn rate is throttled over time, and the path is compensation before denial.
Related topics
- Agent identity and grants are part of the Security plane.
- Agents read from the Data Platform as citizens of it.
- Agents compose across cells and run at the edge. See Platform Architecture.