A useful way to think about NatorOS: the agent owns its prompt and its reasoning. The runtime owns everything that crosses a process boundary. Three things, specifically:
Every workflow has a structured memory namespace. The agent reads and writes facts into it through a typed API, not free text. When the workflow runs again, it picks up where it left off. When a similar workflow runs, it shares facts that are scoped to share.
Memory is not a vector database. It is a typed key-value store with explicit retention. "Hadron May addendum, $25k/month cap" is a fact with an entity, a value, and an expiry. The agent can query it, but it cannot drift it. The CFO can see every fact and edit it directly.
Every external action the agent takes goes through the runtime's tool layer. The tool layer enforces permissions, rate limits, and audit. The agent says "create invoice payment." The runtime checks the approver chain, the dollar limit, the vendor allowlist, then executes.
If the tool layer says no, the agent gets a structured rejection, not a silent failure. The agent's job is to handle the rejection gracefully, usually by escalating to a human.
Every workflow runs as a specific identity, with a specific role, with explicit permissions on every connected system. The CISO sees the agent in their identity provider just like any other employee. The agent cannot do anything a human in its seat could not do.
This is what "operating system" actually means. The model is the user. The runtime is the kernel. The boundary is real and enforced.