The Enterprise Agent OS
Developers build agents. Andyur operates the enterprise boundary around them: who the agent is, on whose behalf it acts, what it may do, how that authority is enforced, and what evidence remains afterward.
Your agents. Your frameworks. Your infrastructure. One operating boundary.
What makes it an Agent OS
Andyur does not replace your agent framework, orchestrator, cloud, or Kubernetes. It provides the common enterprise boundary across them.
Execute
Each admitted run is turned into one accountable execution boundary. Retries and worker restarts stay bound to the same governed run.
Enforce
Credentials, tools, models, destinations, and other consequential actions are constrained outside the model's reasoning loop.
Integrate
Keep the agent framework and infrastructure you already use. Andyur establishes a consistent operating boundary around them.
The security model
Your security model shouldn’t be “sandbox the agent.”
It should be: assume the agent is an intelligent, persistent attacker actively trying to defeat every containment mechanism available to it.
That is the assumption Andyur is built on. The agent is treated as the compromised component, so every control is structural, about what it can reach, rather than advisory, about what it is asked to do.
How a run is governed
Every run passes through the same three steps, and enforcement never depends on the agent behaving.
A manifest says what the agent wants: image, command, model, tools, lifetime. It grants nothing.
Policy intersects the request with what the platform allows. The result can only get smaller. It is signed, and pinned to the image digest and command that were reviewed.
Each run gets its own gateway. It strips whatever the agent set, attaches the approved credential, and routes only to the approved target.
runtime: image: ref: ghcr.io/acme/agent digest: sha256:8b2c…5fbd lifecycle: max_seconds: 7200 model: requested: claude-sonnet access: proxy capabilities: tools: - server: tickets tools: [read_ticket, close_ticket]
image sha256:8b2c…signed command as reviewed lifetime 7200 3600clamped model claude-sonnet api key at the brokerbrokered tools read_ticketgranted close_ticketdropped secrets none in the run
Identity
Every agent and every run gets a cryptographic identity. Short-lived, attested, and verifiable at every hop, without relying on shared API keys or a vendor credential inside the agent.
Delegation & authority
A request is never a grant. Andyur resolves what this agent may do, on behalf of this principal, against this target, for this execution. Authority can narrow; it does not silently widen.
Evidence
One run, one accountable execution. Identity, policy decisions, tool calls, and handoffs are tied back to the execution that caused them.
Bring your own agent
Every enterprise will have agents from many platforms. Andyur is the common operating and trust layer across them.
Andyur runs the image you already build, on any agent framework or none. There is no SDK to adopt and nothing to import. The boundary sits outside the container, so the agent does not need to know Andyur exists.
Next: unmodified stock open-source tools, run under the same boundary with no Andyur awareness at all.
Works with the agent frameworks you already use
Bring the container you build with any of these. Andyur never sees the code inside it.
Questions people ask
Andyur is an enterprise operating system for AI agents: a common operating and trust layer for identity, delegated authority, secure execution, policy enforcement, and attributable evidence across agent frameworks and infrastructure. It does not need to control how the agent reasons; it controls the enterprise boundary around what the agent can actually do.
Package it as a container the way you already do and hand Andyur the image. No SDK, no code changes. Andyur runs it inside a per-run boundary with its own gateway, and everything the agent reaches goes through that gateway.
The agent is never given one. Model keys stop at a broker and tool credentials are attached by the per-run gateway after the call leaves the container. The gateway strips whatever the agent set, so a key the agent never had cannot be leaked, logged or exfiltrated.
It can only call the tools it was granted, through its gateway, for the lifetime it was granted. The grant is computed once by the control plane and can only be narrowed, never widened by the agent. Every call is recorded, so you can see exactly what it did.
SPIFFE and SPIRE for workload identity, any OpenID Connect provider for people, Open Policy Agent over AuthZEN for policy, OpenBao for secrets, OpenTelemetry for traces, and MCP for tools. Each is opt-in and can be swapped for your own.
On your infrastructure: Docker on a single host or Kubernetes for a cluster. There is no hosted service. Run records, memory and audit trails stay in your own database and object store.
It is built to be released as open source, composed from open components with every seam documented. The public repository is not published yet. Request early access to work with it before then.
Built on open standards
Every seam is documented, so you can swap in your own identity provider, policy engine, or vault, and it never locks you in.