AO — Agent Orchestration

01 / Context

We run many AI agents across many projects. Running them safely — isolated per project, cost-bounded, and auditable — is not something off-the-shelf AI tooling provides. So we built the platform ourselves, from scratch.

02 / What we built

• ■ Three-tier hierarchical orchestration (brain › organization › workspace) — one runtime, three roles
• ■ Multi-tenant isolation via scoped tokens, checked server-side on every call — one tenant cannot see another
• ■ Governance: per-task USD budgets, per-organization ceilings, turn/delegation limits, automatic halt on runaway
• ■ Semantic learning: runbook, memory, and history recall via local embeddings (bge) + ClickHouse; a curator auto-distills each agent’s knowledge
• ■ Per-tier encrypted vault (AES-256-GCM), secret redaction, and human-in-the-loop approvals with a full audit trail
• ■ Async delegation (handles / inbox), safe session-reset by rebuilding from the database, and self-provisioning agent pods on Kubernetes

03 / Architecture