Agents can already act. Company OS decides whether they are allowed to.
On one Linux host, each company gets its own directory, sqlite, token, and grant map. ALLOW runs. HOLD waits for an owner. DENY refuses. A grant is not a key. A receipt remains after the fact.
This is not a process jail. Docker plus a second .env still isolates processes. Company OS does not sandbox syscalls.
git clone https://github.com/TheCriners/company-os
cd company-os
bash scripts/docker_eval.shExpect EVAL_OK. CLI only: no dashboard, never 0.0.0.0.
Native, same machine: bash scripts/install.sh then http://127.0.0.1:8760/. The installer prints token_file (chmod 600). Do not paste that value.
Full path: docs/GETTING_STARTED.md · sit-down: docs/SITDOWN.md · operations: docs/RUNBOOK.md
Tenants do not share work, receipts, or sqlite. Money Hunter is a different company and is not a tenant of this tree.
Sanitized example (examples/cedar_clippings). No tokens, no lab paths, no live Packet Press state. Approving a queue row is evidence an owner clicked; it does not by itself publish or spend.
- Operators running more than one agent, client, or business on one Linux host
- People who already use Docker + a second
.envand still need who may act - Anyone who watched an agent ignore “confirm before acting” and wanted a grant log and receipts, not another prompt
- Process or syscall isolation — use Docker, gVisor, or a VM
- A chatbot or LLM framework
- Hosted multi-tenant SaaS, or anyone planning to WAN-publish an operator dashboard
- A production 1.0 product — this is 0.5.0-rc1, a discovery / evaluation release
Security Model 1.2.0, 82 tests: python3 -m unittest discover -s tests.
Map: docs/SECURITY_MODEL.md · docs/security/guarantees.json · SECURITY.md.
A green run is necessary, not a certification. Compromised-host and in-process sqlite access are out of scope.
Does not protect against:
- A compromised host, root, or the Python process itself
- Process / syscall escape
- An operator who binds or tunnels dashboards to the public internet
- Prompt injection that you then execute (payloads are stored as text, not run)
- Shared keys you paste outside the grant system
Dashboards bind loopback, optionally RFC1918 LAN. Never 0.0.0.0. Never WAN-publish :8760, company dashboards, or tokens.
Packet Press is a different company on the same platform, not a renamed storefront:
- https://packetpress.thecriners.com/ — civic briefs (Company #2)
- https://thecriners.com/ — Money Hunter storefront (Company #1)
- https://packetpress.thecriners.com/demo.html — sanitized grants (publish HOLD, marketplace DENY)
That is the public face. It is not the installer and not an operator dashboard.
0.5.0-rc1 — evaluation / discovery, not production 1.0. No product-market-fit claim. Success is an outsider installing this for their own setup.
Apache-2.0. See LICENSE and docs/LICENSE_RATIONALE.md.