AE-OS brings open standards from cloud security, distributed computing and the public logs that browsers use to check website certificates to software agents doing finance work. The sections below follow the order of the film and cover what a finance leader or auditor needs to know about an agent's work.
The film's model of a company
01 Authority
Delegated authority tokens
People sign in and approve with a passkey or a digital identity wallet. When a person signs an instruction, each agent receives a token, a signed digital permission, carrying that instruction's limits: which actions, up to what amount and until when. An agent can pass work to another agent only with the same or narrower limits. Because the token is bound to the agent's identity, another program holding a stolen copy cannot use it.
People Agents
Capability tokens (Biscuit, macaroons)Passkeys (WebAuthn, FIDO2)EU digital identity walletsW3C Verifiable CredentialsvLEI for organizations
SPIFFE is an open standard that gives each piece of software its own verifiable identity, and SPIRE is the open-source software that issues and checks those identities. Before issuing one, SPIRE checks the machine and the exact software build the agent runs on. The identity is a certificate that lasts 15 minutes and renews automatically. Agents therefore hold no stored passwords or access keys that an attacker could trick them into revealing. Every connection is encrypted, and both ends prove who they are (mutual TLS). The operating system decides which connections are allowed, and a manipulated agent faces the same checks as any other.
Agents Controls
SPIFFESPIREMutual TLSeBPF and Cilium network rules
Each agent is packaged as one bundle that names its identity, the tools it may use, its budgets for spending and model use, the rules that govern it and the AI model version it runs. The bundle is identified by a fingerprint calculated from its contents. Any change to a tool, a budget or the model produces a new agent that must be checked again. Before a person approves an agent, developers test it in isolation and replay its work through the rules. It then runs beside live work with its postings switched off.
Agents
Content addressing (CIDs)Spending and usage budgetsShadow deploymentPython and Rust reference code
MCP is an open standard, released by Anthropic in November 2024, that lets an agent discover the tools a system offers and call them. In AE-OS every MCP call goes through one gateway. The gateway verifies the agent's identity and token and runs the policy check, then records the call and forwards it. Existing systems such as SAP, a bank connection or a tax engine are connected through MCP adapters, and agents can work alongside them during a migration.
Agents Other systems
MCPJSON-RPC 2.0OAuth 2.1 for outside servicesIdentity-aware MCP gateway
Company rules, such as spending limits, closed periods and segregation of duties, are written as code and compiled to WebAssembly, a compact format that runs in a sealed sandbox and gives the same answer on every machine. Every action is checked before it runs, and the result (allow, refuse or send to a person) is recorded. From the rule set's fingerprint, an auditor can tell which version applied to any decision.
Controls
WebAssembly (Wasmtime)Open Policy Agent (Rego)Cedar as an alternativeLogged policy decisions
The system records every business change as an event, which keeps a full history and lets any balance be rebuilt. A shared business vocabulary (an ontology) describes suppliers, invoices and postings, and agents use it to request records by meaning, such as all unpaid supplier invoices. Each record has a single owner process, called an actor, that applies its changes one at a time. Many agents can then work in parallel. AE-OS proposes Ray, an open-source framework for distributed computing, to run the actors. Reserving cash, stock and credit before use stops two agents spending the same balance. Work that spans companies runs as a saga: a series of steps, each with a defined way to reverse it.
Ledger Other companies
Event sourcingKnowledge graph and ontologyActors (Ray)Reserved balancesSagas
Each step gets a digital fingerprint, a SHA-256 hash. Fingerprints are combined in pairs, then the pairs in pairs, until one value remains: the root of a Merkle tree. Changing any record changes the root. Each record also links to the signed instruction, rule decision and tool call behind it, and each action returns a receipt proving it is in the log. The log signs its root about once a second. Independent witnesses, such as auditors, add their own signatures, and every auditor then sees the same history. Certificate Transparency, the public log of the certificates websites use to prove their identity, works this way, and Chrome has required it since 2018.
Root matches the signed root
Ledger
Merkle treesSHA-256Certificate Transparency method (RFC 9162)Ed25519 signaturesWitness cosigningPost-quantum signatures (ML-DSA) as an upgrade path
The research paper treats each one as a candidate and compares it with alternatives.
TechnologyIn use todayWhat AE-OS adds
SPIFFE and SPIREA graduated (mature) project of the Cloud Native Computing Foundation; Uber runs it across 4,500 servicesTokens tied to one signed human instruction
MCPOpen standard for connecting agents to tools, released in 2024A gateway that checks identity and rules and records every call
WebAssembly policyOpen Policy Agent compiles its rules to WebAssemblyRule sets identified by fingerprint, with a record of every decision
RaySchedules more than 1.8 million tasks a second; AE-OS posting speed is still to be measuredA business ontology and reserved balances for cash and stock
Merkle logsCertificate Transparency, required by Chrome since 2018; Sigstore Rekor for software releasesLinks from each action to its cause, and a receipt per action
Next
The architecture map shows how these parts connect. The research paper has the full detail, with sources and open questions.
Enterprise information systems were designed for people entering transactions; autonomous software agents can now do much of that work. The paper proposes an agent-native architecture in which every agent has a verified identity and every action is checked against delegated human authority before it runs, then recorded in a log that makes later changes detectable. It sets out how the proposal could be tested, starting with ERP.
Full abstract
The Agent-Native Enterprise Operating System (AE-OS) is a proposed open framework for agent-native enterprise information systems, with ERP as its first application. It assumes digital operations performed mainly by software agents under human authority. The initial architectural hypothesis has four planes that form a control and evidence foundation: business state in an event-sourced knowledge graph sharded across actors (Semantic Data Plane); a short-lived cryptographic identity for every human, agent and tool, with SPIFFE as the candidate standard (Identity Plane); segregation-of-duties, spend and SOX controls evaluated in a sandboxed policy runtime (candidate: WebAssembly) before any action (Compliance Layer); and an append-only Merkle-DAG linking each posting to the signed intent, policy decision, recorded rationale and tool call that caused it (Causal State Ledger). A proposed decomposition of enterprise layers, starting with an Accounting Kernel, sits on that foundation.
The cost model holds the paper's seven-year cost and benefit comparison as live formulas you can change. All figures are modeled for a hypothetical company.
Research question
How should enterprise information systems be designed if software agents are their primary operators?
Thesis
Agents can do most digital operational work without loss of control or auditability, provided identity, business meaning, policy, transaction integrity and evidence are supplied once beneath every agent.
Contributions
A definition of agent-native and the contracts it requires
A reference architecture: four control planes and six enterprise layers
A delegation model from a person's or organization's credential to an agent's action
A causal evidence ledger with receipts for every agent action
Accounting invariants and a control mapping for auditors
An evaluation framework: measures, open problems and an illustrative economic model
How to cite: Lentz, D. (2026). The Agent-Native Enterprise Operating System. Independent research paper.
Open source · free and paid
Open-source code and planned products
The framework and the tools that produce and verify receipts are open source. The paid products are for audit teams and organizations.
For developersFree · Apache 2.0
AE-OS Receipts
A sidecar that runs beside an existing MCP gateway and issues a signed receipt for each agent tool call.
Identity, policy decision and request and response hashes for each call
Darren is a chartered accountant and certified information systems auditor. He leads a digital trust practice at a global professional services firm, and his work covers financial assurance, cybersecurity and digital trust.
CA(SA) · CISAFinancial audit, South Africa and Australia, 2016–2022IT controls · SOC 2 and SOC 3 · WebTrustPKI · post-quantum cryptography · digital identitySpeaker, ID4Africa 2026BCom (Rationum), BCom Hons · NMMU