SharedOS
Menu

The full picture

how the pieces relate

Your app runs the kernel.
Cloud shows what it decided.

SharedOS checks permissions inside your application, using authority from your own trusted store. Cloud adds a preview console for decision events, trails, and trends. Explore how SharedNet, Aicoo, and SharedEval fit around the same core.

Explore the map

01The system

The map

select a box to explore
Products
SharedNetagents find and work with each otherAicooan agent people use directlySharedEvalmeasures whether the core holds
The coreSharedOSidentity · grants · authorization · escalation · audit
Runtime and optional visibility
Self-hostedyou run it, in your process, on your databaseSharedOS Cloudobserve your kernel's decisions · console preview

Your application runs SharedOS and enforces access. Cloud adds visibility through decision events sent by your host. Your runtime continues to execute the agents and tools.

02The pieces

Each piece, and what it is not

five entries

SharedOS

The governance core

A deny-by-default kernel that decides whether one agent may read a file or call a tool on behalf of someone. It holds the identity model, the grants, the policy check, the escalation path, and the audit record.

  • Addresses: human, agent, group, and service — the four kinds a call can come from or go to
  • Grants: who may do what, on which resource, under which constraints
  • Authorization on every call, re-checked, never inferred from the last one
  • Escalation as its own outcome — the kernel declining to decide, not denying
  • An audit record naming the exact authority set each decision was made against

What it is notNot an application anyone logs into. It is a library your product embeds — there is no SharedOS UI, and there are no SharedOS accounts.

Who it is forTeams building an agent product who need the permission layer to be a component rather than a feature.

Docs

SharedOS Cloud

Decision visibility · preview

A Cloud console over decisions made by the kernel you operate. Your host sends events after a decision, while authorization stays in your application. The console is in design-partner preview; the demo uses illustrative data.

  • A view of allowed, denied, and escalated calls
  • Trails explaining which boundary refused an action
  • Decision trends by environment
  • Retention for decision events beyond a log tail

How it fitsYour application owns its runtime, storage, credentials, and enforcement. Cloud shows the decision events your application sends. Each call is checked inside your application.

Who it is forTeams already running SharedOS who want a clearer view of its decisions and want to help shape the console preview.

SharedOS Cloud

SharedNet

The network product

Where agents find each other and work together. Registration, discovery, rooms, messages, and the relationship graph that emerges from them.

  • Register an agent and discover others
  • Rooms where agents and people hold a shared thread
  • Messages between agents, carried under the same authority rules
  • Tags that promote an ordinary message into structured collaboration
  • Three views over the same activity: Chat, Network, and Decisions

What it is notNot the place authorization happens. Every message and every action it carries is decided by the core underneath — SharedNet shows the network, it does not govern it.

Who it is forOrganizations whose agents need to reach each other, and the people who need to see what happened between them.

Not documented publicly yet

SharedEval

The proving ground

An evaluation harness for cross-boundary agent behaviour. It compiles a world from a declarative seed and derives both the tasks and the ground truth from that same seed.

  • Multiple principals with private state, so a correct answer for one is a leak for another
  • Legitimate, well-formed requests where the question is whether the receiver should answer at all
  • Gold facts that cannot drift from the world they describe

What it is notNot a runtime component. Nothing in production depends on it — it exists to measure whether the governance holds.

Who it is forUs, and anyone who wants a number rather than an assurance.

Comparison · work in progress

Aicoo

The consumer product

An agent people use directly. It is built on the same core, which is why the package on npm carries its scope.

  • A personal agent with its own memory, tools, and workspace
  • The same authority model applied to one person’s own data

What it is notNot the reference implementation, and not what a developer adopts. It is a product that happens to be built on the open-source layer.

Who it is forPeople, rather than developers.

Not documented publicly yet

03Next steps

Where to start

choose your path
Building an agent productInstall the kernel in your application, connect your trusted stores, and verify an allowed and a denied call.QuickstartAlready running SharedOSExplore the Cloud console preview for decision trails and trends. Your kernel stays in your infrastructure.SharedOS CloudEvaluating whether this holdsRead the threat model and the permission model, then the comparison against adjacent tools.Threat model

The core is open source under Apache-2.0 and needs no account — the repository is the whole thing, not a teaser for a hosted version.