Agent overview

Oxagen governs the agents your organization builds and runs. It does not run a coding agent of its own. The sandbox layer, subagent fan-out, background tasks, plan mode, skills authoring, and content-generation tools are gone (ADR-043, docs/adr/ADR-043-runtime-excision.md in the repository). What remains is one conversational surface, a governed turn (runGovernedTurn). Its job is to answer questions about the fleet record and the knowledge graph: what your agents did, what context they had, what it cost, and what is waiting for a person.

It has no sandbox, no file system, no browser, and no subagents. Every tool call it makes is a request for a capability contract, called through the same kernel.invoke() boundary as the REST API and the MCP gateway. Each call is IAM-checked, metered, and audit-logged the same way whichever surface triggered it.

The turn loop runs on Stella's headless engine, stella-serve (ADR-053). The engine owns the step cap, loop detection, compaction, and cancellation, but it holds no model key and runs no tool. Every completion and every tool call it wants comes back to Oxagen as a request, and Oxagen answers it under the same rules as any other governed action. There is no in-process fallback. If the engine is unreachable, the turn fails before anything streams.

ArchitectureCopy Anchor Link

The engine sees tool results. It never sees a credential. A denied approval fails the tool call before invoke() runs, and the handler always runs inside the kernel's tenant scope.

What the agent can requestCopy Anchor Link

The contract registry defines the agent's tools. A capability whose surfaces includes agent can be considered for the tool list, filtered by:

1. The tool policy for the turn.
2. Whether the current principal (you, or an agent acting for you) holds the grant.

The agent picks tools from that list to answer your request. Before the handler runs, each call passes the IAM check for you, and a capability that requires approval comes to you as an approval card. The IAM check happens before the handler, never inside it.

Your workspace's decision rules, steering, budgets, and kill switches do not apply to the assistant, whether you reach it from the app, an API key, or MCP. It is Oxagen's agent, and your workspace does not govern or monitor it.

Delegated contextCopy Anchor Link

A delegated turn combines the agent's grants with those of its initiating person. The audit record names both: you, and the agent acting for you.

This is the chain of custody. An auditor reading the audit log can follow any agent action back to the person who started it, or to the identity configured for an automated trigger.

Tool categoriesCopy Anchor Link

See Tools and capabilities for the full list.

What a turn recordsCopy Anchor Link

Every agent turn produces:

• Streamed SSE events: text (the response), tool-call-start and tool-call-end (tool calls), approval-required (an approval card), and usage.
• One frame per tool call on the run's session, the durable record. The run page reads it.
• One ClickHouse tool_invocations row per tool call (analytics).
• A capability.invoke_allowed or capability.invoke_denied security event per IAM decision.
• A credit delta event at turn end (the credits charged for the turn).

Read token usage and spend on the organization Dashboard.