How it works
Four steps to a working agent, and one guarantee about what it can do.
Connect your software
Give AgentOS an MCP server, a REST API — from an OpenAPI document or endpoints you describe — or a database. It reads what is there: endpoints, tables, relationships, MCP tools.
Your credentials are encrypted before they are stored and decrypted only inside the connector at the moment of a call. They never appear in a prompt, a log or a trace. Nobody, including a platform administrator, can read them back.
Review the agent it writes
Every discovered capability becomes a tool with a schema, a risk level and an operation type. From those, AgentOS writes an agent: a name, a purpose, instructions describing the system and how to behave, and a tool selection.
Destructive tools arrive switched on but gated. Leaving deletion out gives you an agent that cannot do its job, so people work around it by hand — with no audit trail. Leaving it ungated is reckless. On, but requiring a human, is the only honest option.
Deploy it and use it
Talk to it in web chat, put it behind Telegram, or save a question as a report that runs on a schedule. Same agent, same checks, whichever door the request came through.
Chat streams the answer and the agent’s reasoning as they happen, so a run that takes thirty seconds is legible rather than a spinner.
Watch what it decides
Every run records its steps in order: what the model proposed, what was validated, what policy said, what actually ran.
Including the calls that were refused. A trace showing only successes would hide the most interesting thing about a run — the moment something was stopped, and why.
What the model can and cannot do
The model decides what to propose. It never decides what happens. Every call it suggests passes these checks first, and none of them consult it.
- 1 Resolve The tool exists, this agent has it, and your organization owns the connection behind it.
- 2 Validate Arguments match the tool’s schema. Undeclared keys are dropped before the connector sees them.
- 3 Authorise Policy decides — including whether the person the agent is acting for actually has the permission.
- 4 Execute Only now, and only through the connector.
- 5 Audit Always, whatever happened.
Validation runs before authorisation on purpose: a malformed proposal should be refused outright, not turned into an approval request a human has to read and reject.
The thing worth trying first
Ask an agent to delete something. It will stop and show you exactly what it wanted to do, with which values, and wait. Approve it and the run continues from where it paused; reject it and the agent is told why, and explains itself.
Your approval covers that one call with those exact values — not the tool, and not the category. If anything about the call changes before it runs, it stops again.