Notes on the agent-native operating system — trust, inspectability, local-first, and life after the app model.
Most AI agents act under their operator's credentials, so every downstream audit log records a human who wasn't there. Why agents need to be their own principals — and why that is an OS-layer job.
If an agent's action doesn't write a record, the system can't know it happened. Why audit trails are a load-bearing part of running agents, not an enterprise checkbox.
Telling an agent not to do something is not the same as making it impossible. The difference between an instruction and a control is the whole security model.
App permissions were built for humans clicking buttons. AI agents need default-deny, typed capabilities — trust granted per action, not per app.
An agent that reports Completed by falling off the end of a loop has told you nothing. AI agent task verification is about what a terminal state is allowed to assert.
Before flipping a repo public, hash your invention disclosures and anchor them on-chain. Defensive publication for open-source projects, done verifiably.
Bolting guardrails onto individual AI apps can't make agents trustworthy. Agent trust is a systems property — it belongs at the OS layer.
The application window assumes a human driver. When the agent drives, the right agent-native interface is a delivery window it opens, fills, and closes.
Agent work should be logged, timestamped, attributable, and replayable — inspectable AI agents are the opposite of today's write-only agent work.
A trustworthy agent runs local-first — a model on your machine — with hosted models on tap, not on the critical path. Continuous with privacy and trust.
An agent-native OS makes the agent the interface — not an app on top of a desktop. Here's what that means, and why the OS layer is where it belongs.