How it works

The standards and technologies behind AE-OS

AE-OS brings open standards from cloud security, distributed computing and the public logs that browsers use to check website certificates to software agents doing finance work. The sections below follow the order of the film and cover what a finance leader or auditor needs to know about an agent's work.

01 Authority

Delegated authority tokens

People sign in and approve with a passkey or a digital identity wallet. When a person signs an instruction, each agent receives a token, a signed digital permission, carrying that instruction's limits: which actions, up to what amount and until when. An agent can pass work to another agent only with the same or narrower limits. Because the token is bound to the agent's identity, another program holding a stolen copy cannot use it.

People Agents

Capability tokens (Biscuit, macaroons)Passkeys (WebAuthn, FIDO2)EU digital identity walletsW3C Verifiable CredentialsvLEI for organizations

In the film: 01 The instruction. The CFO's $250,000 limit goes into every agent's credential →

02 Identity

Software identity with SPIFFE and SPIRE

SPIFFE is an open standard that gives each piece of software its own verifiable identity, and SPIRE is the open-source software that issues and checks those identities. Before issuing one, SPIRE checks the machine and the exact software build the agent runs on. The identity is a certificate that lasts 15 minutes and renews automatically. Agents therefore hold no stored passwords or access keys that an attacker could trick them into revealing. Every connection is encrypted, and both ends prove who they are (mutual TLS). The operating system decides which connections are allowed, and a manipulated agent faces the same checks as any other.

Agents Controls

SPIFFESPIREMutual TLSeBPF and Cilium network rules

In the film: 01 The instruction. 40 agents each receive a credential for one task →

03 Agents

Agent Primitive Objects

Each agent is packaged as one bundle that names its identity, the tools it may use, its budgets for spending and model use, the rules that govern it and the AI model version it runs. The bundle is identified by a fingerprint calculated from its contents. Any change to a tool, a budget or the model produces a new agent that must be checked again. Before a person approves an agent, developers test it in isolation and replay its work through the rules. It then runs beside live work with its postings switched off.

Agents

Content addressing (CIDs)Spending and usage budgetsShadow deploymentPython and Rust reference code

In the film: 02 Agents at work. Each agent does one job within its budget →

04 Connections

Model Context Protocol (MCP)

MCP is an open standard, released by Anthropic in November 2024, that lets an agent discover the tools a system offers and call them. In AE-OS every MCP call goes through one gateway. The gateway verifies the agent's identity and token and runs the policy check, then records the call and forwards it. Existing systems such as SAP, a bank connection or a tax engine are connected through MCP adapters, and agents can work alongside them during a migration.

Agents Other systems

MCPJSON-RPC 2.0OAuth 2.1 for outside servicesIdentity-aware MCP gateway

In the film: 02 Agents at work. Agents confirm balances with First Coast Bank →

05 Rules

Policy as code in WebAssembly

Company rules, such as spending limits, closed periods and segregation of duties, are written as code and compiled to WebAssembly, a compact format that runs in a sealed sandbox and gives the same answer on every machine. Every action is checked before it runs, and the result (allow, refuse or send to a person) is recorded. From the rule set's fingerprint, an auditor can tell which version applied to any decision.

Controls

WebAssembly (Wasmtime)Open Policy Agent (Rego)Cedar as an alternativeLogged policy decisions

In the film: 03 The controls. A posting into the closed August period is refused, and a $612,000 write-down goes to the CFO →

06 Books

Event sourcing, actors and sagas

The system records every business change as an event, which keeps a full history and lets any balance be rebuilt. A shared business vocabulary (an ontology) describes suppliers, invoices and postings, and agents use it to request records by meaning, such as all unpaid supplier invoices. Each record has a single owner process, called an actor, that applies its changes one at a time. Many agents can then work in parallel. AE-OS proposes Ray, an open-source framework for distributed computing, to run the actors. Reserving cash, stock and credit before use stops two agents spending the same balance. Work that spans companies runs as a saga: a series of steps, each with a defined way to reverse it.

Ledger Other companies

Event sourcingKnowledge graph and ontologyActors (Ray)Reserved balancesSagas

In the film: 04 Across companies. Kestrel and its UK subsidiary agree one entry, recorded in both ledgers →

07 Records

Merkle trees and signed checkpoints

Each step gets a digital fingerprint, a SHA-256 hash. Fingerprints are combined in pairs, then the pairs in pairs, until one value remains: the root of a Merkle tree. Changing any record changes the root. Each record also links to the signed instruction, rule decision and tool call behind it, and each action returns a receipt proving it is in the log. The log signs its root about once a second. Independent witnesses, such as auditors, add their own signatures, and every auditor then sees the same history. Certificate Transparency, the public log of the certificates websites use to prove their identity, works this way, and Chrome has required it since 2018.

Root matches the signed root

Ledger

Merkle treesSHA-256Certificate Transparency method (RFC 9162)Ed25519 signaturesWitness cosigningPost-quantum signatures (ML-DSA) as an upgrade path

In the film: 06 Closed and checked. The auditor recomputes the root. Try altering a receipt yourself →

Where these technologies run today

The research paper treats each one as a candidate and compares it with alternatives.

TechnologyIn use todayWhat AE-OS adds

SPIFFE and SPIREA graduated (mature) project of the Cloud Native Computing Foundation; Uber runs it across 4,500 servicesTokens tied to one signed human instruction

MCPOpen standard for connecting agents to tools, released in 2024A gateway that checks identity and rules and records every call

WebAssembly policyOpen Policy Agent compiles its rules to WebAssemblyRule sets identified by fingerprint, with a record of every decision

RaySchedules more than 1.8 million tasks a second; AE-OS posting speed is still to be measuredA business ontology and reserved balances for cash and stock

Merkle logsCertificate Transparency, required by Chrome since 2018; Sigstore Rekor for software releasesLinks from each action to its cause, and a receipt per action

The architecture map shows how these parts connect. The research paper has the full detail, with sources and open questions.

Open the architecture map Read the research Watch the film

Research paper

The Agent-Native Enterprise Operating System

Darren Lentz · independent research

Summary

Enterprise information systems were designed for people entering transactions; autonomous software agents can now do much of that work. The paper proposes an agent-native architecture in which every agent has a verified identity and every action is checked against delegated human authority before it runs, then recorded in a log that makes later changes detectable. It sets out how the proposal could be tested, starting with ERP.

Full abstract

The Agent-Native Enterprise Operating System (AE-OS) is a proposed open framework for agent-native enterprise information systems, with ERP as its first application. It assumes digital operations performed mainly by software agents under human authority. The initial architectural hypothesis has four planes that form a control and evidence foundation: business state in an event-sourced knowledge graph sharded across actors (Semantic Data Plane); a short-lived cryptographic identity for every human, agent and tool, with SPIFFE as the candidate standard (Identity Plane); segregation-of-duties, spend and SOX controls evaluated in a sandboxed policy runtime (candidate: WebAssembly) before any action (Compliance Layer); and an append-only Merkle-DAG linking each posting to the signed intent, policy decision, recorded rationale and tool call that caused it (Causal State Ledger). A proposed decomposition of enterprise layers, starting with an Accounting Kernel, sits on that foundation.

Read the paper (PDF)Cost model (Excel)Open the architecture map

The cost model holds the paper's seven-year cost and benefit comparison as live formulas you can change. All figures are modeled for a hypothetical company.

Research question

How should enterprise information systems be designed if software agents are their primary operators?

Thesis

Agents can do most digital operational work without loss of control or auditability, provided identity, business meaning, policy, transaction integrity and evidence are supplied once beneath every agent.

Contributions

A definition of agent-native and the contracts it requires
A reference architecture: four control planes and six enterprise layers
A delegation model from a person's or organization's credential to an agent's action
A causal evidence ledger with receipts for every agent action
Accounting invariants and a control mapping for auditors
An evaluation framework: measures, open problems and an illustrative economic model

How to cite: Lentz, D. (2026). The Agent-Native Enterprise Operating System. Independent research paper.

Agent Controls Pack · for finance, audit and SOX teams

Controls for AI agents in finance systems

A risk and control matrix (RCM) for AI agents that prepare, post and approve transactions in an ERP. It is designed to slot into your existing RCM, and each control includes suggested audit tests and the evidence to retain.

For finance leadersFree · PDF

Free summary

A short read for CFOs, controllers and audit committee members. It explains where AI agents create control risk, gives example controls from each domain of the full pack, and lists the questions to put to a team before an agent posts to the ledger.

Download the summary (PDF)

For audit, SOX and risk teamsPaid · Excel workbook

Full pack

The complete matrix as an Excel workbook, ready to tailor to your own agents, thresholds and testing plan.

45 controls, each with its risk, control activity, suggested tests of design and operating effectiveness, and the evidence to retain
References to COSO 2013, NIST AI RMF, ISO/IEC 42001 and the EU AI Act
Guidance on scoping and testing, a mapping summary and a glossary

USD 149One-off payment · licence for one organization

Buy the full packCheckout by Paystack

Control domains in the pack

AAgent identity and accessAn identity for every agent, access that expires automatically and limits tied to the person the agent acts for

BChange management for agentsChanges to agent instructions approved, tested and logged like any program change, with the model version fixed

CAuthority and application controlsValue limits, segregation of duties and approval routing

DOperations and monitoringA tamper-evident record of every action, a tested way to stop an agent and daily reconciliation of agent activity to the ledger

EModel and tool providersProvider assessment, SOC report review and a fallback if a provider fails during close or a payment run

FData and privacyThe minimum data for each task, retention schedules and approved AI tools

GGovernanceAn inventory of agents with named owners, risk assessment and an annual review of each agent

HReporting and closeIndependent review of journals, reconciliations and estimates that agents prepare

Licence

The pack is licensed to the purchasing organization for internal use. You may adapt the controls into your own risk and control matrix and share them with your external auditors and advisors. Resale, redistribution and publication are not permitted.

Payment and delivery

Payment is taken by Paystack. Paystack charges the rand equivalent of the US dollar price, and your bank may add a currency conversion fee. The download link is emailed to you as soon as payment is complete.

Questions about the pack: darren@ae-os.org

Terms of sale

The seller is Loomis Group (Pty) Ltd, trading as AE-OS, registration number 2026/574717/07, South Africa. The seller is not registered for VAT, so no VAT is added to the price.
Each purchase grants one licence for one organization on the terms in the licence section above.
If the file is faulty or does not match the description on this page, email darren@ae-os.org within 14 days of purchase for a corrected file or a full refund.
The seller's liability for the pack is limited to the price paid. These terms are governed by the law of South Africa.

The summary and the full pack are general guidance and do not constitute legal, audit, accounting or regulatory advice. Each organization should tailor the controls to its own processes, systems, risks and obligations.

Open source · free and paid

Open-source code and products

The receipts specification and the software that issues and checks receipts are open source. The Agent Controls Pack and the planned Receipts Pro are paid products.

For developersFree · Apache 2.0

AE-OS Receipts

A Python library, command line and proxy that sits between an agent and the tools it calls through the Model Context Protocol (MCP). It issues a signed receipt for each call, and an auditor can check the receipts on their own machine with the issuer's public key, without access to the issuing system.

The agent's identity, the person it acts for and a cryptographic fingerprint (hash) of each request and response
A tamper-evident log built on the RFC 6962 Merkle tree that Certificate Transparency uses, with signed checkpoints
The proxy permits only approved tools and records refused calls

Repository Receipts tour on the map

For audit and SOX teamsFree summary · paid full

Agent Controls Pack

A control matrix for AI agents used in finance, with suggested tests and evidence for each control.

Referenced to COSO 2013, NIST AI RMF, ISO/IEC 42001 and the EU AI Act
Tests of design and operating effectiveness
Free summary for finance leaders

See the pack

For organizationsPaid · planned

Receipts Pro

Retention, auditor access and evidence exports for production use, offered first as a self-hosted licence.

Long-term retention
Read-only auditor portal
SOX and SOC 1 evidence exports, single sign-on and signing-key management

Built on the open components

The paid offerings are software licences and downloadable documents. The open components are available to everyone under the same Apache 2.0 licence.

Progress

Released · Oct 2026
AE-OS Receipts 0.1
Specification, Python library and command line, and an MCP proxy that records every tool call an agent makes. Receipts and the log's history can be checked without access to the issuing system. The tests, including the RFC 6962 Merkle tree test vectors, run on every change on Python 3.9, 3.11 and 3.13.
Released · Oct 2026
Agent Controls Pack 1.0
Full workbook and free summary.
Next
Rust verifier
A second, independent verifier that checks the same test vectors.
Next
Receipts from existing gateways
Issue receipts from the MCP gateways and agent frameworks organizations already run.
Later
Receipts Pro
Self-hosted licence with retention, an auditor portal and evidence exports.
Research
Agent-native ERP
Research into the other layers of the AE-OS architecture.

Get involved

Issues, pull requests, test vectors and audit experience are welcome. Contributors are credited by name.

GitHub repository darren@ae-os.org

Specifications CC BY 4.0 · code Apache 2.0 · maintained by Darren Lentz

ae-os/ ├─ spec/ receipts format ├─ python/ library, CLI, MCP proxy ├─ examples/ agent pays an invoice, auditor checks └─ rust/ planned