Skip to main content
HUMΛN

HumanOS

HumanOS is where the first three layers become behavior. On every governed call it composes the answers — who is acting, what they can do, who allowed it — and enforces your policies against them. It does not decide what your rules should be. It makes sure they are followed.

The call path

Every governed call — human.call, the protocol's single entry point for consequential work — passes through the same sequence:

  1. Identity — verify the caller's Passport and, for agents, the delegation chain behind it.
  2. Authorization — check the call's scope against the active delegation; expired or revoked grants fail here.
  3. Capability routing — if the call needs an executor, filter to identities whose Capability Graph evidence meets the requirement; consider cost only among the qualified.
  4. Execution — run the work, with your configured gates: approval steps, spend ceilings, environment constraints.
  5. Provenance — emit a signed record to the Ledger: caller, authority, decision, outcome.

The useful mental model is AWS IAM, not an autonomous manager: a policy engine that enforces access rules without deciding what your policies should be.

Escalation is a primitive, not an afterthought

When confidence drops or stakes rise past a threshold you configured, HumanOS routes the call to a qualified human — with the same context the agent saw, not a bare notification. That is Workforce: humans in the execution path as a first-class protocol feature, reachable from agent code as ctx.escalate().

Learning is a governed event

HumanOS observes execution and can propose behavioral adaptations — a routing change, a threshold adjustment. Proposals are all it produces. A human approves, rejects, or edits each one before anything changes, and every accepted proposal is recorded with the same provenance as any other decision. Improvement never becomes silent drift.

Work with HumanOS

Next in the ladder: Provenance →