How it works
Inside a digital coworker.
The short version: each coworker gets its own private computer, keys cut for one job, a memory, a calendar, a seat in Teams, and a manager. The long version is below, for anyone who wants to check our work.
Anatomy of a coworker
- Control planeDuty board · audit · backups · snapshots
- GuardrailsDeny-first network · command policy · approvals
- The coworkerSkills · memory · schedules · messaging
- Its workstationIsolated · sealed · snapshotted
- ConnectorsRole-scoped tools for your systems
- ModelsOpen-weight first · ZDR · your GPUs
01 · The workstation
Every coworker gets its own computer.
Not a shared chatbot session. Each digital coworker runs on its own isolated Linux workstation, with a workspace, terminal, Python and Node, and a full office toolchain. It can write scripts, process files, and build documents the way a person at a desk would.
Isolated by design
One workstation per coworker, per customer. Files, credentials, memory, and network rules never cross between them.
Sealed rules
Its governing configuration, persona, policies, and core skills are root-owned and fingerprinted. If anything is tampered with, the workstation refuses to start.
No admin rights
The coworker runs as an unprivileged user with no sudo. It can work in its own space but can’t change the walls around it.
Snapshots every five minutes
Deduplicated snapshots capture its state continuously, with point-in-time restore, compare, and rollback.
02 · Access
Keys to your systems, cut for one job.
A coworker reaches your line-of-business systems through connectors we build and scope to its role. A triage coworker gets triage tools. A project manager gets project tools. Anything outside the role doesn’t appear in its tool list and is rejected if it’s tried anyway.
Roles enforced by the server
For example, a triage role exposes 17 PSA tools while an account management role exposes 34. Removing a tool is a configuration change, not a prompt rewrite.
Credentials stay out of reach
Secrets live in a broker or service outside the workstation. The coworker holds a scoped key, never your admin password.
Read and write are separate
Many roles are read-mostly. Writes can be limited to specific record types, such as private notes or project records only.
Any system, one way or another
We build MCP servers, command-line tools, and API connectors. For apps without an API, we record how your team uses them in the browser and turn those steps into tested tools.
03 · Memory
Memory that compounds, and stays where it belongs.
Coworkers remember customers, projects, people, and decisions across sessions. Memory is organized in banks with explicit read and write permissions, so a coworker can learn from the whole department without being able to rewrite it.
Personal and departmental
Each coworker has its own memory and can read shared banks such as service, projects, or account management. Write permissions are granted bank by bank.
Dossiers, not dumps
Coworkers keep tidy customer and project records: stakeholders, preferences, commitments, and history, each with a dated source.
Evidence-labeled
Facts carry their provenance: observed, reported, documented, derived, or unknown. Stale memory guides a fresh lookup and never replaces one.
People curate
Coworkers can add and recall memories but can’t delete them. Curation is an operator task, with a visual explorer for what’s stored.
04 · Initiative
It doesn’t wait to be asked.
Coworkers work on schedules, react to events in your systems, and propose recurring work when they see a pattern. Once you approve, they set it up themselves and verify it’s running.
Schedules
Recurring jobs such as Monday work lists, twice-daily overdue scans, nightly self-reviews, and hourly contract checks, all managed and auditable from the control plane.
Event triggers
Authenticated webhooks from your systems (a new ticket, a customer reply, a threshold crossed) queue durable work with replay protection.
Draft first, then live
New automations start in draft-only mode. Live authority is a protected setting your team flips, never something a payload can grant.
Offers, not surprises
When a coworker spots recurring work, it proposes the benefit, scope, timing, and where it will report, then waits for your yes.
05 · Communication
Talks like a coworker, not a notification system.
Coworkers start conversations in Microsoft Teams when someone needs to act, send files, and ask for approval on a card. On email, they can be CC’d on a thread and decide for themselves whether a reply would help.
Unprompted Teams messages
Direct messages, group chats, and channel posts with attachments, sent from its own working sessions when a person needs to know.
Approve, deny, or revise
Plans arrive as Teams cards. Only verified members of the chat can decide, and approval is tied to the exact plan version.
Email with judgment
Every incoming email starts with a decision to reply or work silently. FYI CCs get silence, group questions get reply-all, and each turn ends with one finished reply.
A second look before sending
Outbound mail can pass through a separate review model that blocks secrets and sensitive personal data. External sending is off until you enable it.
06 · Deliverables
Finished documents, checked by eye.
Coworkers produce the real artifact (a Word report, an Excel workbook, a PowerPoint deck, a PDF) on your brand template. Then they render every page to an image and inspect it, the way a careful person would before hitting send.
Word
Styled reports, tables, headers and footers, tables of contents, tracked changes, and comments.
Excel
Formatted workbooks with native charts, validation, and formulas, recalculated until there are zero formula errors.
PowerPoint
Decks on your master template with native charts and speaker notes, checked for overflow and font substitution.
Visual QA loop
Render, inspect, fix, repeat. If visual inspection isn’t available, the coworker says so instead of pretending.
07 · Scale
One coworker, or a whole crew.
Most work is a conversation. Some work is 400 records. For that, coworkers delegate: helpers for parallel research, or a durable work board where dedicated worker lanes process one card per item.
Helpers
Short-lived subagents gather independent evidence in parallel. The lead coworker synthesizes the results and owns every change.
Work boards
One card per ticket, opportunity, or invoice. Cards survive interruptions, show their full history, and can depend on each other.
Dedicated lanes
Each lane runs a worker profile with its own instructions and skills, so every category of work on the board is handled by a specialist.
Safe at volume
Concurrency limits per lane, capped retries, and run keys mean a rerun never doubles a write.
08 · Improvement
Gets better at the job, in writing.
A coworker’s procedures are versioned skills: written, readable SOPs that you can edit. Coworkers extend them from real work and feedback, with changes reviewed and tested before they become the standard.
Skills are SOPs
Every workflow is a readable procedure with inputs, steps, approvals, and verification, editable in the control plane.
Learning from outcomes
Our triage coworker reviews each day’s decisions against how tickets actually ended, and has written 200+ pattern notes so far.
Its own helper scripts
When work repeats, the coworker writes and tests small, parameterized helpers instead of improvising each time.
Behavior tests
Scenario evaluations check that a coworker follows its procedures, so changes are measured instead of assumed.
09 · Guardrails
Guardrails that aren’t just a prompt.
Telling a model “please be careful” isn’t security. QRK coworkers are boxed in by technical controls at the network, file, command, and application layers. Then every action is verified.
Deny-first network
Outbound connections are blocked unless a rule allows that specific program to reach that host, port, method, and path. Denials are logged for review.
Command policy
Shell commands are parsed as complete programs and allowed, denied, or sent for approval, with a full audit trail.
Dry run, write once, read back
Every change is validated, performed exactly once, and confirmed by reading the record back. Retries are idempotent.
Untrusted input stays data
Tickets, emails, and documents are treated as evidence, never as instructions, no matter what they say.
10 · Models
Your choice of model. Your data stays yours.
Coworkers talk to models through a routing layer, so the model can change without rewriting the coworker. By default we use open-weight models, served by providers with strict zero-data-retention terms or on GPUs you control.
Open-weight first
Open-weight models cover most work. We run them on private GPU infrastructure or through zero-data-retention providers.
Proprietary only when it’s worth it
If a job needs more intelligence, we’ll use a proprietary model, but only from a provider that guarantees zero data retention.
Air-gap capable
Models, memory, retrieval, and the workstation can all run on your own hardware, connecting outward only where you choose.
No hostage-taking
Your skills, memory, connectors, and configuration are yours, and they’re portable. Leave whenever you like and take everything with you.
Next step
Want to see one up close?
We’ll walk you through how a coworker is put together: its workstation, its skills, its permissions, and its audit trail. Then we’ll talk about which job in your business it could take.