The seven jobs of an agentic OS, one at a time

An agentic operating system does seven jobs: it defines roles, sets depth, certifies agents, governs sources, enforces bounds at the moment of action, routes work to human gates, and keeps the record. The clearest way to understand each is by the failure it prevents. Take one away and a specific, predictable thing goes wrong.

Why describe an agentic OS by its jobs?

Architecture diagrams show boxes and arrows. They tell you what connects to what, not what would break if a box were missing. A list of jobs, each tied to a failure, is easier to test against your own estate. For each job you can ask: who does this today, where, and what stops the failure it guards against?

The seven jobs are not seven products. In some firms several are done by one system; in others one job is split across teams. What matters is that each job is done somewhere, consistently, for every agent. The full picture is set out in the governed agentic operating system, explained. Here we take them one at a time.

Which jobs decide what an agent is allowed to be?

1. Roles

A role defines the agent's job: which requests it takes, which it declines, who it hands off to and who owns it. It prevents scope creep, the drift by which a helpful agent starts answering questions and taking actions nobody assigned to it. Roles are also why narrow agents beat general ones; the case is made in should one AI agent do everything?.

2. Depth

Depth sets how far an agent may act: read, draft for a person to send, execute routine work within bounds, move money or take hard-to-undo actions, or coordinate other agents. It prevents uniform trust, where an agent trusted to look something up is equally free to change it. Because each action needs its own depth, an agent can execute card blocks while still only drafting refunds.

3. Certification

Certification proves, on your own cases, that an agent can do its work well enough to hold a given depth. It prevents unearned authority, where depth is granted because someone configured it rather than because evidence supported it. Certificates should lapse and be renewed, because the agent, its sources and its model all change over time.

Which jobs decide what an agent knows and does?

4. Sources

The sources job governs what the agent may rely on, and stamps each fact with where it came from. It prevents weak evidence carrying strong actions, such as a forged email changing a payee, or a stale policy document driving a decision. It also answers a practical question: how AI agents get the right data at the right time, without being handed everything in case it helps.

5. Enforcement at the moment of action

Enforcement checks every action, as it is attempted, against every bound that applies, and returns a verdict. It prevents the gap between policy and behaviour: rules that exist on paper or in a prompt but are not applied to the action itself. Without this job, every other job is advisory.

Which jobs keep people in charge?

6. Human gates

Human gates hold actions that need a person and route them to a named approver with authority to release them. It prevents silent autonomy, where an agent completes something consequential because no step required a person to see it first. Gates belong in the platform so that every agentic workflow inherits them, rather than each workflow building its own.

7. The record

The record files every verdict, with the bound that decided it and the facts relied on, in an append-only store. It prevents unreconstructable decisions, the situation in which a customer complaint, an audit or an incident review asks why something happened and nobody can say. An editable log cannot settle a dispute; an append-only one can.

What goes wrong when one job is missing?

The jobs depend on each other. Removing any one weakens the others, and the failure tends to surface somewhere unexpected.

Many firms have strong versions of two or three jobs, usually the record and some human gates, and weak or absent versions of the rest. That combination produces a common pattern: good evidence of mistakes after they happen, and little to stop them happening.

So use the list as an audit. For each live agent, write down where each job is done and by whom. Gaps are usually obvious within an hour. Where a job is done inconsistently, for example gates built separately in every workflow, note that too, because inconsistency is how a job quietly goes missing for one agent.

Then prioritise by consequence. Enforcement and sources matter most for agents that can move money or change records. Certification matters most where depth is high. The record matters for every agent from the start, because it is the evidence for every other job.

Where Pryme fits

Pryme does all seven jobs in one layer. Agent Studio assembles the brief with role, sources and connections. Attest certifies each agent against your own cases across seven gates. The Pryme Context Protocol stamps provenance. The minimum chain enforces at the moment of action, holds what needs a person, and files every verdict in an append-only record.