Devon Park ยท Mar 3, 2026
A useful way to think about NatorOS: the agent owns its prompt and its reasoning. The runtime owns everything that crosses a process boundary. Three things, specifically:
Every workflow has a structured memory namespace. The agent reads and writes facts into it through a typed API, not free text. When the workflow runs again, it picks up where it left off. When a similar workflow runs, it shares facts that are scoped to share.
Memory is not a vector database. It is a typed key-value store with explicit retention. "Hadron May addendum, $25k/month cap" is a fact with an entity, a value, and an expiry. The agent can query it, but it cannot drift it. The CFO can see every fact and edit it directly.
Every external action the agent takes goes through the runtime's tool layer. The tool layer enforces permissions, rate limits, and audit. The agent says "create invoice payment." The runtime checks the approver chain, the dollar limit, the vendor allowlist, then executes.