The Governor

The operating system for autonomous agents.

When programs became untrusted, computing grew an operating system — a layer that owns the resources, meters them, isolates the damage, and keeps the audit trail. Agents are at that same moment now. They run for hours, spend real money, and edit real repositories, yet most stacks still run them the way DOS ran software — straight on the hardware, on the honour system. The Governor is the missing layer above the agent. It decides what the agent may run as, bounds what it may spend, proves whether it did the work, and undoes it if it didn't — and what the agent did becomes what it is allowed to do next.

The layer

Govern. The Governor is the control plane that sits above an autonomous agent and answers the two questions nothing else in the stack can — did it actually do the work it claims, and what did that cost, was it even allowed to spend it.

The gap it fills

The agent stack of 2026 is surprisingly complete — runtimes that drive tool calls, orchestrators that queue work, billing systems that meter tokens. What has been missing is the component that bounds spend before it happens instead of reporting it after, and that proves the work instead of taking the agent’s word for it. For a chat app, that gap is a rounding error. For an unattended agent running overnight on a model that bills $50 per million output tokens, it is the entire problem.

We call it an operating system rather than a harness for one reason: a harness runs the agent; an operating system decides what the agent may run as — and feeds what the agent did back into what it is allowed to do next.

How a run works

Every run passes through the same governed lifecycle, and there is no fast path around it:

select → guard → reserve → checkpoint → run → verify → contain → settle → record → earn trust

A hold is taken before a token is generated; the workspace is snapshotted before a file is touched; an independent judge tries to refute the result on observed evidence; a refuted run is rolled back recoverably; the true cost settles honestly either way; and every run appends to an immutable ledger that decides what may run unattended tomorrow.

Trust — slow to earn, instant to lose

Autonomy is not a setting. Tier 0 needs approval for everything; Tier 1 comes after ten verified passes; Tier 2 — fully unattended — after twenty runs at a 95%+ verified rate. One verified failure drops the tier to zero, however flattering the average, and nothing in the system can write trust into the ledger except the truth.

Now in private beta — AOS

The Governor has grown into a product: AOS, a self-hosted agentic AI service in miniature — the stack the frontier providers run internally, scaled to your hardware. Four front doors (a library, a CLI with a live console, an OpenAI-compatible gateway, and an MCP server), local-first routing with earned escalation to frontier models, an offline mode that fails closed, and 600+ automated tests gating every push. Visit the AOS product site ↗ for the full picture, or watch the video above.

Read the full story

This one is deliberately educational — the why matters as much as the what. Read the long-form explainer, The Governor — why the agentic age needs an operating system, which traces the idea back to the operating systems it borrows from — or explore the interactive architecture ↗, every layer and stage rendered as living diagrams. Or request a briefing.