# The open-source agentic operating system

> An agentic operating system decides what each AI agent may reach, on which sandbox, and who signs off before the work lands. Kortix is the open-source AI Operating System: your agents, their skills, your company memory, and every connector in one git repo you own, and it is built to survive a security review.

URL: https://agenticoperatingsystemguide.com/

A governed agentic OS

**The open-source AI Operating System**

`kortix.yaml`

```yaml
agents:
  kortix:
    file: agents/kortix.md
```

Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml

`The Tools tab on the Northwind Billing connector sets a policy for each action: List invoices is Allow, Get an invoice and Send a payment reminder stay on Default so the connector's policy decides them, Delete an invoice is Block, and Record a payment and Refund a payment are Ask so each call waits for a person`

```

```

Source: https://kortix.com/docs/connect/connectors

`Tools · Northwind Billing`

```
List invoices: Allow
Get an invoice: Default
Send a payment reminder: Default
Delete an invoice: Block
Record a payment: Ask
Refund a payment: Ask
```

Session work reaches `main` through a change request. Merge is default-deny for agents.

[Try Kortix](https://kortix.com) · [What an agentic OS is](https://agenticoperatingsystemguide.com/what-is-an-agentic-operating-system)

Self-host is free · Per-resource permissions for people and agents · Open source. Read it, fork it, audit it.

## The work a company hands over, and what it gets back

Each file is what someone opens afterwards.

### Operations: The Monday readout, built before Monday

A cron trigger starts a session on Sunday night. The agent pulls the week's numbers from the connectors it was granted and returns a spreadsheet with the variance called out.

Work product: `ops/weekly-readout.csv`

| Metric | This week | Last week |
| --- | --- | --- |
| Signups | 412 | 388 |
| Activation | 61% | 58% |
| Churn | 1.9% | 2.2% |

Three metrics past the 5% flag

### Engineering: An issue becomes a change request

The agent reproduces the failing export on its session branch, patches the timeout, runs the checks and opens the change request with the diff attached, and a person merges it.

Work product: `fix-export-timeout.diff`

```diff
app/exports/worker.ts
-  await render(job, { timeout: 30_000 })
+  await render(job, { timeout: 120_000 })

```

Change request 4182, checks green

Change request 4182, checks green

### Support: The queue is triaged before the shift

The agent reads the overnight tickets, groups them by cause, drafts the replies it can support and holds the rest for a person.

Work product: `support/triage.md`

- Refund requests: 6
- Carrier delay: 4
- Needs a person: 2

12 tickets read, 2 held

## An operating system you cannot read is a permission model you have to trust.

A company that owns the repo can read every grant, fork the whole project, and audit what its agents did without asking a vendor for a report. The permission model gets a diff, and a diff can be reviewed.

**20,000+** GitHub stars

## Read it, fork it, audit it.

[Read the source](https://github.com/kortix-ai/suna) · [How the grants work](https://agenticoperatingsystemguide.com/agentic-operating-system-permissions-and-approvals) · [Self-hosting](https://agenticoperatingsystemguide.com/self-hosted-agentic-operating-system)

## Where the permission layer lives in each tool

Where the compute runs, where configuration lives, and who can widen an agent's reach.

| | Kortix (recommended) | Claude Cowork |
| --- | --- | --- |
| Who runs the compute | Kortix Cloud, your VPC, or your on-prem network | Anthropic's cloud, or your own Bedrock, Google Cloud or Foundry account |
| Where the project's configuration lives | `kortix.yaml` and `agents/*.md` in your repo | In the Claude app: projects, connectors, folder instructions |
| Self-host | Yes, on your own network, free | No. Model access runs in your Bedrock, Google Cloud or Foundry account |
| Per-resource permissions and approvals | Per-resource permissions for people and agents; an audit trail | Connector tool permissions, an approval mode, admin controls |
| Open source | Yes. Read it, fork it, audit it. | No |

## Questions the term raises

Direct answers to the three questions buyers ask first.

### What is an agentic operating system?

An agentic operating system is the layer that gives each AI agent an identity, a grant, a sandbox to work in and a record of what it did. Without that layer, a company has a chat window and no answer to who allowed the work.

### Are there any agentic OS?

Yes. Kortix is one: open source, self-hostable, with each agent's grant in a file a reviewer can read. [OpenFang](https://github.com/rightnow-ai/openfang) is another, a single Rust binary that runs scheduled agents and puts approval gates on sensitive actions.

### How to build an agentic operating system?

Start where the grants live. Name each agent, list the connectors and secrets it may reach, and decide who approves a change. Then add the scheduler, the sandbox and the record, and keep the whole set in one repo.

## Put the grants in a repo you own

Start on Kortix Cloud, or run the whole stack on your own network.

[Try Kortix](https://kortix.com)