An AI operating system a business gets plugged into, not built around

Almost every AI automation is built around one company's workflow. Change the company and you start again — new integrations, new prompts, new assumptions baked into the plumbing. For an owner-operator running more than one business, that means paying to solve the same problem repeatedly, and ending up with systems that can't be compared, audited or staffed the same way.

The brief was to invert that. Not an AI assistant fitted to a business, but an AI operating system a business gets plugged into: one place where work is scoped, assigned, executed, reviewed, approved and deployed, with a record of who decided what — regardless of what the business actually does. The first two tenants had almost nothing operationally in common, which was the point rather than a complication.

That is harder than it sounds, for a reason most agent systems duck. An agent that can take actions is, from a security standpoint, an untrusted actor holding credentials. If the model drives the workflow, the workflow is only as trustworthy as the model was that day — and no owner is going to onboard a second business onto a system that can't tell him why something shipped.

The core is a ten-state work-order lifecycle — intake, scoped, assigned, in progress, review, approved, deploying, deployed, measuring, closed — enforced server-side, so an agent cannot move work to a state it hasn't earned. Approval and deployment gates sit at the transitions that matter, and exactly one agent in the hierarchy is permitted to deploy anything.

Those ten states are deliberately domain-free. Nothing in the lifecycle knows what industry the work belongs to, which is what makes onboarding a business a configuration exercise rather than a rebuild: the governance, the audit trail, the approval gates and the agent hierarchy already exist, and a new business brings its own work into them. A shared dashboard sits across every business in the system rather than one per company, so the owner sees all of it in one place.

Seven agents run across a seven-node cluster on a mesh VPN. The orchestrator holds the state machine; subordinate agents run on their own hardware and reach it only through a purpose-built bridge exposing three operations, polling on a heartbeat. Agents never touch the API directly.

The architectural decision that makes it dependable: no model calls inside the state graph. The lifecycle is pure deterministic logic — fast, free and fully testable — with model work happening outside it. Every choice like this is recorded with its rationale, including the ones that were reversed.

One of those reversals shows how the system was built. The originally-specified agent runtime was evaluated and rejected for the control plane on documented security grounds — published CVEs for remote code execution and sandbox escape, plus hundreds of malicious skills found in its marketplace — and replaced with a hardened alternative. The technology changed because the evidence changed, not because of preference.