Contact

Program case study

ActantBot

Security and runtime-safety agents on the ActantOS kernel.

The shipped WorkDesk bot family — employee IT support on the ActantOS kernel — and the safety properties the lab is still proving for agents like these.

WorkDesk — shipped with ActantOS

  • Secure AI Bots
Visit actantos.com/platform/workdesk All projects
Editorial illustration of a service-desk bot answering from an approved runbook while every action is filed into an audit ledger
Program artwork, not a screenshot of the software.

Research context

ActantBot sits in the Secure AI Bots area: it puts agents to work inside a real organisation, which is exactly where the question of what an agent may do stops being abstract.

WorkDesk ships the governed baseline — approved runbooks, three separated consents, private security intake — on the same enforcement kernel the ActantOS program researches.

The coordination guarantees under that baseline remain research targets: shared approval admission (C1) and approval–decision–effect safety (C2) are ActantOS's open questions, not WorkDesk claims.

Approach

  1. Answer employee questions only from runbooks the organisation has approved.
  2. File every request through three separated consents, and take security reports in a private channel.
  3. Let the ActantOS kernel decide every write, and return a receipt that reconciliation can check afterwards.

System architecture

Diagram — how a WorkDesk action runs: the bot answers from approved runbooks, asks through separated consents, takes security reports privately, and every write is decided by the ActantOS kernel and reconciled afterwards.

  1. Application

    WorkDesk ActantBot family

    IT, Secure, Access, and Know — employee IT support on the ActantOS kernel.

    • WorkDesk bot family

  2. Guidance

    Approved runbooks

    The bots answer from runbooks the organisation has approved, not free-form advice.

    • Approved runbooks

  3. Consent

    Three separated consents

    Requests are filed through three separated consents, so no single approval covers everything.

    • Three separated consents

  4. Intake

    Private security intake

    Security reports go to a private channel, not a shared queue.

    • Private security intake

  5. Enforcement

    ActantOS kernel

    Every write is intercepted and decided by the same kernel ActantOS ships — policy before action, always.

  6. Record

    Ticket receipts & reconciliation

    Every action returns a receipt, and a reconciliation job compares what was attempted with what actually happened.

    • Ticket receipts & reconciliation

Current implementation

Published status
WorkDesk — shipped with ActantOS

The status above is the published one: WorkDesk ships with ActantOS and is documented on the program site.

What this does not claim

  • The shipped Jira Service Management connector is an at-most-once mock with queryable receipts; the live connector is planned, behind the same policy boundary.
  • Single sign-on ships as self-hosted Keycloak with PKCE; Entra ID federation is coming soon, gated behind a pilot.

Evidence

What the record establishes

The evidence is the shipped WorkDesk suite, documented at actantos.com/platform/workdesk: approved runbooks, separated consents, private security intake, and ticket receipts on the ActantOS kernel.

What it does not establish

WorkDesk does not establish the multi-agent coordination guarantees. The program states those as hypotheses, and this page repeats that wording.

Roadmap

Every item below is planned, proposed, or under investigation. None of it is shipped, and this list is not a release schedule.

  1. Planned

    Live Jira Service Management connector

    Planned: WorkDesk ships a connector mock with queryable receipts today; the live Service Management integration is coming soon, behind the same policy boundary.

  2. Planned

    Entra ID single sign-on

    Planned: the build ships self-hosted Keycloak with PKCE today; Entra ID federation is coming soon, gated behind a pilot.

Collaboration

WorkDesk grows through IT and security teams that want employee-facing agents governed from day one.

Partner with us How the lab works

Work on a program with us.

Each program takes on partners where the research question meets real practice — clinical review for AIMed, agent runtime governance for ActantOS and Agent Platform, academic workflows for ScienzaOS, and document-heavy collections for AgenticOCR.

Discuss a collaboration
  • Clinical pilots
  • Research collaborations
  • Dataset partnerships
  • Student theses
  • Open-source contributions