Not policy an agent obeys, physics it cannot break.
Prompt-level guardrails are guidance a model can talk its way around. LoQOS moves the guardrails below the agents entirely: what an agent may touch, spend, or reach is enforced by the operating system, so an out-of-bounds action isn't forbidden, it's impossible.
Immutable image
A reproducible OS image built on NixOS: the same fund, byte-for-byte, every time it boots. No drift, no snowflake servers, a clean audit of exactly what is running.
Per-agent micro-VMs
Every agent runs isolated in its own Firecracker micro-VM. A compromised or misbehaving agent is contained to its own sandbox, unable to reach the rest of the fund.
OS-level policy kernel
Validated "golden rules" compile to an OPA policy layer that adjudicates every tool call, file write and spend: the single choke point no agent can bypass.
Kernel-level egress
eBPF network rules physically constrain what each VM can reach. An experiment on-path can work; the same experiment off-path simply has nowhere to go.
Humans approve the envelope once. Agents are free inside it.
Every autonomous campaign, whether research or self-improvement, runs strictly inside a human-signed Mandate: its objective, the exact files it may touch, its budget in tokens, dollars and wall-clock, its legal scope, and what earns promotion to human review.
Compiled two ways
A mandate compiles to OPA policy at the control layer (denying any tool call, file write or spend outside the envelope) and to eBPF egress rules at the network layer (so the VM physically cannot reach anything off-path).
Autonomy inside, hard-stop outside
Within the envelope the agent has full autonomy, with no per-step approvals. Budget exhaustion hard-stops the run and returns the best artifact plus unresolved issues; it never hides a partial failure.
Budget envelopes
The Budget Governor enforces spend caps with priority-class shedding that always exempts safety spend, so cost control can never quietly disable the fund's own guardrails.
Deliberately boring, deliberately layered.
No kernel fork. LoQOS is assembled from proven components, each doing one job, so the security story is legible to an examiner and to us.
An immutable image, per-agent micro-VMs, a policy kernel, and kernel-level network enforcement: the four layers that make the envelope real.
LoQOS lands at v0.9, with the Foundry.
The platform is designed now and hardened over the roadmap: policy and mandate consoles arrive at v0.8, and the OS image itself, with self-improvement running inside it, at v0.9.
See the full roadmap →