v0.1.0-alpha.5 · npm next · Apache-2.0
Grant. Delegate. Execute.
You could write the permission layer yourself.
We already did.
Install SharedOS
Embed the kernel in your application, or run it on your own infrastructure.
npm install @aicoo/sharedos@0.1.0-alpha.5When one agent asks another to read a file or call a tool, something has to decide whether it’s allowed. SharedOS is that decision. Access is scoped per file, per tool, and per action, and checked on every call. Neither the request nor the model can grant itself authority.
01Under the hood
Architecture
three layersIdentity, storage, connectors, policy, credentials
Capabilities, filtered discovery, exact-call authorization
Standard, Codex, DeepSeek, or a custom plugin
The host owns the world. SharedOS guards the turn. Embed the runtime as a library or expose the same contracts through an HTTP boundary. Read the architecture.
02Capabilities
Features
each one opens its doc01
Deny by default.
Nothing is reachable until a grant says so. Not a file, not a tool, not a single call. The default survives every refactor because it is the absence of a grant, not a setting.
02
Every call, decided.
Three outcomes, never a fourth. Allowed, denied, or handed back to a human. The last of those is not a denial.
03
An agent can't see what it can't use.
Tool discovery is filtered by grant before the model ever receives a catalog. There is nothing to be talked out of, because the option was never on the table.
04
Memory is files, not a black box.
What an agent knows lives in files you can list, read, snapshot, and revoke. One permission model covers state and action, with no second hidden store.
05
The runtime changes, the envelope does not.
Swap the model, the agent loop, or the whole harness. Limits, provenance, and the audit record stay wrapped around every turn.
06
Reproducible audit.
Each decision carries the content identifier of the exact authority set it was made against: not "which rule matched", but which authority, replayable byte for byte.
07
The host owns the world.
Runtime selection and the capability ceiling are trusted host configuration. Never a model-authored request, never something a prompt can raise.
08
Observability, not an ops console.
A light panel over the decisions your agents already make: what was allowed, what was refused, and enough of a trail to answer why.
09
Open source, TypeScript, yours.
Apache-2.0 on npm. Embed it as a library or put the same contracts behind an HTTP boundary. The authority model does not change either way.
03Observability
Console
design partner previewThe panel answers two questions: did it connect, and why was that call refused. Approval queues belong in your product, not ours. See SharedOS Cloud.