Opbox runs AI agents as a real workforce, not a chatbot bolted onto the side. Each agent is an actor in an org chart with a chief-of-staff at the top, and it does its work by calling the exact same kernel verbs a person calls. What an agent is allowed to do is set by an autonomy level and a per-agent grant, never by trust, so an agent’s reach is bounded by construction rather than by hoping the model behaves. The reasoning engine itself is held in a cage: it touches the system only through the one front door, every call permission-checked and written to the permanent record.
What it does
The agent loop drives work by calling verbs, and only verbs. An agent is given a goal and works toward it by deciding on one move at a time: call a kernel verb, or declare itself done. Every move is routed straight through the same dispatch that the chat box, the buttons, and the command line use. The loop has no write path of its own, so an agent that drafts a document, gathers a fact, or advances a matter is doing exactly what a person would do, through exactly the same checks. A denied or failed call is just a turn the agent continues from, not a crash, so the model reasons over its own history including the refusals.
Power is bounded by an autonomy level and a grant, not by trust. Each agent carries an autonomy level (L0 to L3) and a grant, which is a per-agent allow-list of the verb-packs it may use. The dispatch gate resolves both before any handler runs: a verb outside the grant is forbidden, and a move above the agent’s autonomy is held for a human. Neither can be widened by the agent itself. When an agent confers capability onward, the no-amplification rule applies: what it hands down is a subset of what it holds, and it can never grant what it was not itself granted.
A standing roster with a real chain of command. The org area defines who exists and who reports to whom. There is exactly one immortal chief-of-staff; beneath it sit heads, and beneath them workers. The lattice is guarded at the verb: a head can only create workers, only the chief-of-staff creates a head, and a move can never make a cycle, orphan a head with reports, or re-parent the chief-of-staff. Creating a roster agent mints its actor, its bound key, its SOUL reference, and its persistent grant in one reconciled step.
Ephemeral help, convened for a task and torn down after. Alongside the standing roster, a head can convene bespoke help for one task: a single sub-agent, or an N-seat panel for a council-style review. A convened seat is itself a subset-token identity, so it cannot exceed the convener by construction: it inherits the workspace, its autonomy is floored at the convener’s, and its scope is the intersection of what was asked for and what the convener can grant. When the work is done the convening is dissolved, which revokes each seat’s key and identity and drains its work, but the outcome and the audit survive. The actor is destroyed, never the record of what it did.
One durable queue, claimed atomically. Work for agents lives on a single task queue. Each task is a projection of matter or board work and carries the canonical verb and payload a worker will drive. A claim is a guarded, single-winner lease: under contention exactly one claimant wins and no task is ever double-claimed. A claim grants a time-bounded lease, and if the worker dies the lease expires and the task can be requeued from its last checkpoint, so a crashed run resumes rather than restarting from scratch.
Bounded by construction: depth, autonomy ceiling, and an iteration cap. Tasks thread through a parent reference and are capped at a fixed depth, so work cannot spawn without limit. Agents are consumers of the queue, not producers: an agent actor cannot mint a new task at all, which is denied up front before any write. A task carries an immutable autonomy ceiling set when it is created, and a claimant whose resolved autonomy exceeds that ceiling is refused, so a higher-privileged worker cannot bypass the bound. The agent loop itself runs under an iteration cap: a run that does not complete within its move budget ends and escalates to a human rather than looping forever.
Escalation and incident controls. When an agent reaches something above its ceiling, or something a policy routes to a person, it escalates: this mints a one-shot approval gate through the same gate machinery a human uses, and the task holds until the gate is decided. For the worst case there are two reversible break-glass levers held at the owner tier: a freeze mass-disables every agent and bumps all sessions, and a lockdown does that and also slams external egress shut and revokes token scopes. Both are reversible, both audited.
The engine is consumed, the governance is owned. The reasoning engine sits behind a single client seam, so the whole loop is exercised against the real dispatch and the real database with no live engine in the build. A release build pulls in no model and no engine HTTP dependency, so the tree stays hermetic and cannot silently run an agent: a live agent only exists when the caged engine is wired in. The agent is treated as untrusted; the kernel is the trust boundary.
How you use it
Stand up the roster. Create the agents you need under the chief-of-staff: a head for a line of work, workers beneath it. Each new agent gets its identity, its bounded key, and its grant in one step. Re-parent an agent under a different head, promote it between tiers, or disable it reversibly when you want it parked without tearing it down.
Set what an agent can touch. Give an agent its grant (the verb-packs it may call) and its autonomy level. Attach a skill to fold a catalogue capability into the agent. Read back an agent’s grant matrix or its persona (its SOUL and spec) to see exactly what it is configured to do, all from the admin side.
Convene help for a one-off task. When a head needs bespoke effort, convene a single sub-agent or a panel for a task, let the seats run under their bounded scope, and dissolve the convening when the work lands. Open a convening to read its seats, their verdicts, their spend, and the synthesis.
Watch the queue. From the ops console, list the agent tasks with their status and last error to see what is queued, leased, escalated, or failed. Requeue a failed task to re-drive it from its checkpoint.
Pull the brakes in an incident. If something is wrong, freeze the org to disable every agent and bump all sessions, or lock it down to also cut external egress and revoke token scopes. Both are reversible, and both leave a full audit trail of what was cut and when.
The kernel verbs behind it
Each goes through the one front door - permission-checked and audited before it runs (see Security & permissions). These are the verbs most specific to running agents; the full set is across the agent, agenttask, and org references.
The standing roster:
org.agent.create- add a head or worker node; reconcile mints the agent’s user, key, and SOUL.org.agent.move- re-parent an agent under a head, with the lattice guard (no cycle, no orphan, not the chief-of-staff).org.agent.promote- change a node’s role tier, keeping the lattice valid.org.agent.disable- reversibly bench a roster agent; its keys and grant survive.org.agent.remove- terminally remove a node (the chief-of-staff is immortal; no self-removal).org.agent.get- read one roster node and its grant.org.agent.list- read the org chart: role, who reports to whom, and each grant.
Bounding power:
agent.autonomy.set- set an agent’s autonomy level (L0 to L3); no self-raise, no amplification.agent.grant.set- grant or deny a verb-pack to an agent, bounded by the grantor’s own scope.agent.grant.get- read the grant matrix of packs against agents.agent.skill.attach- attach a catalogue skill into an agent’s spec.agent.persona.get- read an agent’s persona: its SOUL reference and effective spec.
Convening ephemeral help:
agent.convene- convene one ephemeral sub-agent as a subset-token seat.agent.convene.panel- convene an N-seat panel sharing one budget pool, each seat a distinct lens.agent.dissolve- tear a convening down to the ledger, revoking each seat’s key and identity while keeping the audit.agent.convening.get- read one convening with its seats’ status, verdicts, spend, and synthesis.agent.convening.list- list the live and recent convenings in the workspace.
The task queue:
agenttask.create- mint a queued task, depth-threaded; agents cannot create tasks, only consume them.agenttask.claim- atomically lease a task; exactly one claimant wins and no task is double-claimed.agenttask.checkpoint- persist durable progress and a heartbeat so a run is resumable.agenttask.escalate- mint a one-shot approval gate and hold the task until a human decides.agenttask.requeue- re-drive a failed task from its checkpoint.agenttask.list- read the queue with each task’s status and last error, for the ops console.
Incident controls:
org.freeze- mass-disable every agent and bump all sessions (reversible).org.lockdown- a freeze that also slams external egress shut and revokes token scopes (reversible).
For how agents fit the wider picture, see Agents. See the full set in the agent verb reference.