What is System9

System9 is a distributed superintelligence: a system that turns many models, agents, data sources and sites into one intelligence with one executive function, and that gets more capable the further it reaches.

The architecture is the product. What makes that architecture deliverable is that it carries three things normally sold as three products, on one substrate:

• a data platform with a catalog, engines, open lakehouse formats, object storage, messaging, streaming, and pipelines;
• an agent platform where models and agents are directory entities with identities, grants, budgets, and a decision gate that can refuse them; and
• a security and governance plane that is not a layer on top but the path everything runs through.

It is built to run in a cloud account, in your own facility, on a ship, or on a network with no route to the internet. That is the default mode rather than a deployment option, and it is the constraint that shaped everything else.

The one paragraph version

System9 runs as a mesh of independent cells, each a complete instance of the platform, coordinated into nodes by a self-registering fabric. Every actor is a cryptographic identity: people, service accounts, AI agents, cells, nodes, and field devices share one directory, one authorization path, one classification ladder, and one tamper-evident record. Work happens inside workspaces, or inside clean rooms where parties who do not trust each other compute a joint result without exposing raw data. The same product runs on one machine, across a federated estate, or on a disconnected tactical cell, with no separate edition and no re-architecture.

The shape of an estate

Figure: the estate hierarchy. An organization mints nodes. A node is a system identity over a set of cells, optionally grouped into service groups, plus the Edge Agents that reach where a cell cannot run.

Table equivalent

Level	What it is
Organization	The top boundary. Organizations mint nodes and own users, agents, and policy
Node	A logical, cryptographic system identity over a set of cells. It survives cell replacement, so it is the face peers see
Service group	Cells grouped for a purpose: an erasure set, a replication group, a workload boundary. Can span clouds and regions
Cell	The unit of deployment. A complete instance with its own databases, its own object store, its own service processes. Not a worker node
Edge Agent	A small, statically linked, signed binary for field devices, holding a delegated identity from a parent entity

Four ideas follow from that shape, and the rest of the documentation is consequences of them.

A cell is a whole platform. Not a shard, not a worker. Up to nine services run per cell, and a single cell carries the complete data platform, the agent platform, and the security plane. You can run exactly one. You scale out later without changing the model.

A node is the identity, not the machine. Cells can die and be replaced. The node is what the rest of the estate knows, what holds the roll-up view, and what answers an estate-level question.

Isolation is between workspaces, not between customers. A workspace is the universal ownership boundary and every entity gets one. A clean room is a mutual-distrust overlay on a workspace, for parties who must collaborate without trusting each other. The deciding question is never "how sensitive is this data?" It is "how many trust domains are in the room?"

"Edge" is a location, not a lesser build. The same cell can run in a cloud region, in a rack on a factory floor, or in a vehicle. The Edge Agent is a different thing: a device-resident binary that reads from a cell, or operates sovereign with no cell at all.

The conditions that make it one intelligence

Many actors working on the same problem only add up to one intelligence if certain properties hold everywhere, without exception. An actor with no identity cannot compose with the others. A decision with no record cannot be learned from. A boundary that holds in one service and not another is not a boundary.

So seven properties hold at every layer, in every service, on every path, down to a device in the field. Any competitor can ship a feature; making a property hold everywhere is a different kind of problem, and it is the one that decides whether scale produces coherence or noise.

Thread	What it means
One identity	A person, an agent, a sub-agent, a device, a workload, a cell, a node, and an organization each carry cryptographic identity in the same directory, so every action traces back through an unbroken chain to a human or organization that authorized it
One classification ladder	Five levels plus compartments, enforced in the query plan of seven engine types, in object storage, on streams, on messages, at the model, and on the device
Chained proof	Roughly sixteen independent tamper-evident chains, each answering a different question an auditor asks, with gaps counted so a missing entry is distinguishable from an append failure
Refusal	Consequential actions pass a gate that can say no at the action boundary, and the refusal is recorded. Most systems permit and log
Offline operation	Nothing phones home to start, licensing verifies offline, policy holds last-known-good, inference runs locally, and an air-gapped peer is modeled as an absent edge rather than a failed one
Signed at origin	A frame, an observation, a model, a policy, a job, a workflow step, a code change, and a licence are each signed where they are produced, and the signature travels with them
Metering	Compute, storage, agent runs, inference, and crypto operations are metered and attributed to an entity, into a hash-chained chain you can verify yourself

Read the full set in the seven threads.

What runs on it

Area	What it carries
Data Platform	Catalog with lineage and data contracts, Iceberg and Delta at format parity, a 34-type structure engine over a Redis-compatible wire, object storage with erasure coding, governed messaging, streaming SQL with KQL and PromQL, pipelines across cells, and a cross-organization Data Exchange
Agent Platform	Agents as directory entities, a durable and replayable workflow journal, crews and formations, a Model Context Protocol surface, skills, local model serving, and a governed coding agent that also runs disconnected
Intelligence	Content intelligence over files and objects, estate discovery and mapping, sensor intake with provenance at capture, surveillance and identity resolution, tactical communications, and battlefield operations
Security	One directory for people, machines, and AI, deny-closed authorization, a large cryptographic core with hardware key storage and post-quantum hybrid constructions, classification enforcement, SIEM on open schemas, and evidence generation mapped to controls
Platform Architecture	The cell model, region to zone to rack to cell topology, nine replication scopes, disaster recovery, the cell network fabric, and the executive engine that runs at every scale

Who it is for

• Government and public sector, where a cloud-only vendor fails residency and accreditation, and procurement asks for control evidence it can verify itself.
• Defense and intelligence, where operation is disconnected, classification handling is not optional, and coalition sharing has to work without a shared control plane.
• Regulated enterprise, carrying a data platform plus a SIEM plus an identity story plus an AI governance layer, and paying for every seam between them.
• Industrial and critical infrastructure, where the data that matters is behind an OT boundary on a link you do not control.
• AI-forward organizations, where agents can already reach production systems and nobody can say what stopped one.

What it is not

• It is not an open-source project. Cells are distributed as machine images under licence, and access is controlled.
• It is not an IDE. The coding agent is a governed surface you submit work to and review, not an editor plugin.
• It is not a frontier lab. System9 runs their models, local ones, or none, by policy. The value is the system around the model.
• It is not a data warehouse with AI attached. The data platform exists because an intelligence needs governed reach into data, not the other way round.

Next

• Why System9 if you are deciding whether this is worth your time.
• The intent if you want the argument behind the architecture.
• Quickstart: your first cell if you would rather just run it.