Governance is the product. Intelligence is a commodity.

Agents should be free to think — to interpret ambiguous requests, plan, choose approaches. They should not be free to act without control. We refuse the free-for-all swarm model: reasoning is delegated to the agent, execution flows through a deterministic, recordable path.

We treat an agent the way an enterprise treats an employee: it has an identity, it is issued credentials, it is granted least-privilege access, it acts on delegated authority, and everything it does is attributable to it. Humans and agents appear at par in one Members directory.

Model quality is a fast-moving, externally supplied input. Governance — the ability to safely delegate authority to autonomous software and prove it afterward — is the durable, defensible value. We invest where the trust problem lives, not where the model vendors compete.

Authentication happens at the edge and is verify-only. Authorization is always re-derived from the policy store at request time, never trusted from stale token claims. Enforcement happens at the resource server, not the UI — so an attacker who learns a downstream agent’s URL and forges a call is still rejected.

When the platform is uncertain — a policy engine unreachable, provenance ambiguous, a delegation token malformed — the answer is no. Every design document in the authorization and egress set defaults to denial. Enterprises can trust a system that is safe by default far more than one that is permissive by default.

Lock-in is a liability. Agents are built on open, portable frameworks over a thin SDK and open contracts; every agent is a lean standalone service speaking the open A2A standard and needs no AgentOS database to run. Making it easy to leave is what makes enterprises comfortable adopting.

Every heavy dependency sits behind a contract: the LLM provider behind an env-driven router, the workflow engine behind a runtime seam, the identity provider behind a config value, the vector store bring-your-own.