01 · judgment◆
principalagent:supportmodel · memory · skills · autonomy
people·apps·A2A·channels
Platform
One system from intent to evidence.
Agents decide. Programs order work. Capabilities act. Gateways publish. Every side effect crosses the same door and lands in the same journal.
Agent OS · live system map intent → evidence
02 · process▣
published Programcustomer_refund@3versioned · durable · operable
portal·Agent·Program·Automation
03 · boundary⌘
MCP endpointpartner-toolsauth · catalog · policy
Claude·Codex·your clients
Capabilitysupport.issue_refundtyped effect · risk tier act
sourceconnector · payments
grant● active now
inputrefund.request.v1
call context
actoragent:support
acting foruser:dana
surfaceAgent · interactive
one admission doorPAUSEsupervised · act
ALLOWPAUSEDENY
execution
✓ user:danaapproved once
connectorrefund · success
Journalsource of truth
14:02:11Run started
→14:02:13Admission paused
→14:23:44Gate resolved
→14:23:45Capability completed
The product model
Three ways to ship. One way to govern.
Choose the surface by the kind of work—not by a different runtime underneath it. Agents, Workflows, and Gateways all resolve to the same Capabilities, authority, admission, and journal.
01 · Agent◆
When the next step depends on judgment.
A durable principal with model strategy, memory, skills, tools, channels, and an autonomy posture.
Explore Agents →02 · Workflow▣
When the process should be published.
A Program promoted to a named, versioned, durable contract that people can inspect and operate.
Explore Workflows →03 · Gateway⌘
When an MCP client needs the right front door.
A composed endpoint with its own authentication, catalog, exposure rules, and autonomy policy.
Explore Gateways →The unit of power
Every path resolves to a governed verb.
A Capability says what can happen. A binding says who has the verb. The invocation point supplies the posture for this call. Keeping those concerns separate makes one action safely reusable everywhere.
The source can change—from a platform primitive to your WASM or an external connector. The admission boundary does not.
Go inside Capabilities →Capability contract · support.create_ticketreusable authority
built-infilesplatform primitive
pluginsupport.wasmyour logic
connectorZendeskexternal system
stable identitysupport.create_ticketversion · current
- input
- ticket.request.v1
- risk
- act
- executor
- plugin
Capabilitythe actioncontract + executor
≠Bindingthe grantprincipal + scope
≠Invocationthis callsurface + posture
consumed by
◆Agentbound surface
▹Programrun once
▣Workflowexplicit resources
⌘Gatewaylive request
Run · customer_refund/01J9K6reconstructed from journal
14:02:11.482Run startedagent:supportthread pinned
14:02:12.190Model attempt failedroute Anothing committed
14:02:12.904Fallback completedroute Bresponse committed
14:02:13.907Capability pausedadmissionpending gate durable
process gonejournal remainsanother pod wakes
14:23:44.115Gate resolveduser:danaallow · this call
14:23:45.618Run completedagent:supportresult + usage sealed
replayauditmetricsusageone truth
Durability by default
The answer is not the state.
Processes disappear. Providers fail. Humans answer later. Noorle records committed facts as events so the work can recover without asking a model to reconstruct what probably happened.
The improvement loop
What was learned becomes an asset.
The work does not collapse back into a context window when the Run ends. Noorle separates what happened, what is worth remembering, what source material says, and reusable judgment about how to do the job well.
Skills are reviewable instruction packages, loaded on demand and frozen per conversation. Better judgment can compound without making yesterday's work impossible to reproduce.
Agent · research-leadreviewable improvement
next Runbetter preparedsame governing boundary
Power without ambient authority
The workload never owns the rules.
Pick the execution boundary the work needs. Identity, authority, admission, and the journal remain in the control plane outside every one of them.
control planeoutside every executor
01Identitywho is acting
→02Authoritywhat is granted now
→03Admissionmay this call execute
→04Journalwhat became true
governs ↓no execution tier governs itself↑ reports
01 · Plugin▲
Sandboxed in process
Compact, versioned customer logic.
WASM02 · Sandbox▢
Disposable machine
Session-scoped operating-system work.
isolated Linux03 · Computer▣
Persistent machine
An Agent-bound environment that can retain state.
the machine is not the Agent04 · Connector◇
External execution
Remote systems behind encrypted credentials.
governed at the callcapability selects the executoradmission proof reaches it first
Go to the owning layer
Start with the question.
The platform stays legible because each concept has one job. Follow the layer that owns the decision you are making.
QuestionLayerOwns
Who should decide the next step?◆Agentsidentity · judgment · memory · skillsExplore → What may touch the outside world?◇Capabilitiescontracts · grants · executorsExplore → How should this process be published?▣WorkflowsPrograms · versions · durable RunsExplore → Which tools should this MCP caller see?⌘Gatewayscomposition · auth · exposure · policyExplore → Why was this operation allowed?✓Trustauthority · admission · attribution · journalExplore →Put the whole system behind one job.
Start with an Agent. Add process and surfaces when the work demands them.