01
Compute → Intelligence → Work
The center of gravity is moving off raw compute and model scores, onto agents, workflow and the outcome they produce.
The Open Operating Workspace for Human + AI
Where humans and AI actually get work done.
Not another collaboration tool. WorkspaceX links context, agents, action, evidence and memory into one chain — so what you ask for gets done, and can be checked.
A closed chain of five linked stages: context, agents, action, evidence, memory — each feeding the next.
Every answer shows its source. Watch one get withdrawn.
Pick a decision on your desk this quarter. Four agents work it from five sources. Press any line to see its evidence — then watch the reviewer strike the most tempting claim, or the most feared, and say why.
A scripted demo: the sources and steps are sample material, replayed in your browser. No model runs and nothing you do here is sent anywhere.
- Workforce & skills
- Sales win rate
- AI-native enterprise path
- AI return on investment
- AI transformation strategy
- AI governance
- Customer operations
- Frontline expertise
- Design thinking
- Innovation
The demo runs in your browser and needs JavaScript. Everything below explains the same thing in words.
Software → Work
The next platform shift is not about which model is smartest. It is about where work happens — and who is accountable when it does.
02
Seat → Unit of work → Outcome
Software stops being a tool a person operates. A person states intent; the work gets executed and delivered back.
03
Software budget → Service budget
AI does not only sell software. It reaches into research, legal, finance, engineering, design and operations — work that used to be bought as a service.
04
Model moat → Context + Trust
Models are replaceable and getting more so. Your context, your verification, your permissions and your organizational memory are not.
Today AI answers well. The work still falls apart.
Every step works on its own. The work as a whole has no shared state, no evidence and no memory.
A question goes into chat. The answer comes back. Someone re-types it into the real application. Someone else reviews it in their head. The result lands in a document nobody opens again. Between every pair of steps, context evaporates — and nothing that happened can be proven later.
The same five steps, except nothing is dropped between them. Context carries forward, every action is taken inside a boundary, every result leaves evidence, and what was learned becomes the starting point of the next run rather than being thrown away.
Context evaporates
What the model knew at 10:04 is gone at 10:06. The next person — or the next agent — starts from nothing.
Action is disconnected
The answer is in one window, the system of record in another. A human is the integration layer, by hand, every time.
Nothing can be proven
“It looks right” is not verification. Without evidence there is no accountability, and without accountability AI never gets the important work.
The core experience is not a conversation. It is a loop that can be verified.
Intent, explore, create, act, verify, learn. Humans and agents work the same loop — with different responsibilities at every stage.
Human
Agent team
Together
Evidence
A six-stage circular loop — intent, explore, create, act, verify, learn — with human and agent responsibilities shown on each stage.
What the loop produces is not one answer. It is organizational capability that compounds.
One surface. The work, the agents and the proof — in the same place.
Not a chat window bolted onto a document. A canvas you and your agents both act on, with the evidence trail running alongside it.
Acme · Q3 market entry
3 agents working
Illustration of the working surface. The evidence column is the part that does not exist anywhere else: every claim on the canvas can be traced back to what produced it.
What is actually in it today.
Not a roadmap. These are the surfaces that exist and run — each one sharing the same context, the same agents and the same evidence trail.
Chat with an agent team
Not one assistant — a team with assigned roles that work in parallel, pass work to each other and hand it back to you.
Canvas and diagrams
A spatial surface you and the agents both draw on, where a diagram is a structure the system understands, not a picture.
Deep research
Guided, multi-source investigation that comes back with an outline, the sources behind it, and what it rejected.
Agents and skills
A runtime for defining agents, granting them tools, and packaging what works as a skill other teams can run.
Live collaboration
Multiplayer presence and real-time sync, so a session with four people and four agents stays one session.
Meetings and transcription
Real-time transcription that lands in the workspace as context, not as a file nobody opens.
Research and interviews
Surveys, interview studios and the analysis behind them, with the raw material kept attached to the conclusions.
Projects and governance
Organizations, roles, permissions and asset governance — the part that decides whether any of the above is allowed to touch production.
One workspace. Three scales. One context.
Not three products bolted together — the same context flowing from your own desk to your team to the whole organization.
I work
Research · Writing · Analysis · Planning
Your own agents, your own knowledge, your own files. Local-first where it matters, and nothing leaves without you saying so.
We work
Canvas · Docs · Meetings · Projects
Multiplayer with agents in the room. An agent team joins the project the way a colleague does — with a role, a brief and a record.
The organization works
Ontology · Memory · Governance · Standard skills
Decisions, evidence and learning accumulate into an asset the company owns — not a transcript in someone’s account.
Five layers. The top moves fast. The middle must not move at all.
Pick a layer to see what changing it would disturb. Models are replaceable and tools are composable. Your semantics, your evidence and your organizational memory are the part you cannot afford to lose.
Replace a surface and nothing below notices. The experience layer is where you should be able to move fastest.
Swap the model — frontier, domestic or fully local — and nothing below this line changes. Your ontology, your evidence and your permissions are untouched.
Change the harness and everything above it has to be re-verified. This is where authorization, execution, evidence and rollback live, so it is the layer that must not move casually.
Change how your organization is modeled and every layer above inherits the change. This is the most expensive thing in the system to get wrong, and the most valuable to get right.
Move between cloud, on-premise and local-first without touching anything above. Deployment is a choice, not a fork of the product.
Why the split is where it is
Everything above the harness is meant to be replaced — surfaces, models, tools, even the vendor. Everything at and below it is the part that is yours: how your organization is modeled, what was decided, what was proven, who was allowed. Put the line anywhere else and you either cannot move, or you lose the thing that made moving worthwhile.
Five stacked layers, from infrastructure at the base through ontology and knowledge, the harness, agents and workflow, up to the experience layer. Select a layer to see what changing it would disturb.
An agent you cannot audit is an agent you cannot deploy.
The harness sits between a capable model and your systems. It is what makes an agent’s action one your organization is willing to answer for.
Every action passes six gates: authorize, execute, observe, verify, evidence, and — when verification fails — rollback. The run above shows a failing check being caught and reversed. That path is the point: a system that can only succeed cannot be trusted.
Memory is more than transcripts
A chat log tells you what was said. Organizational memory tells you what was decided, on what evidence, what was done about it, what the result was, and what everyone learned. That is the part a competitor cannot copy and a model upgrade cannot replace.
Organizational memory = decision + evidence + action + result + learning
A knowledge graph linking people, projects, decisions, evidence, actions, artifacts and memory.
And the person who never signs in
Most people a result has to convince will never open this product. Someone they trust hands them a document in a meeting, and they have to decide. For them, everything above counts only if it survives into that document — so these three are requirements on what comes out, not on the runtime. We are designing to them now; a result that fails them is not finished.
You can tell what was generatedWhich passages a model wrote, and which a person did, marked in the document itself — not in a settings page nobody opens.
Every claim opens to its sourceDoubt a sentence, click it, and the original is there. If a conclusion cannot be opened, that is itself the finding.
Uncertainty is shown, not smoothedConfidence and what is still unknown are part of the result. A document with no visible doubt is not more trustworthy; it is less.
Start where the work is valuable and the result can be checked.
Look for four things: digital inputs, a process you can break into steps, a result someone can check, a risk you can govern. Where all four hold, agentic work is real rather than impressive — in very different disciplines.
Reviewing an inbound contract against your own playbook.
- Who is in the room
- A clause-extraction agent, a reviewer agent that holds the playbook, a drafting agent for the redline — and the lawyer who decides what is actually acceptable.
- What gets checked
- Every deviation is matched to the playbook clause it departs from, and every extracted term points back to its location in the source document. A clause the system cannot place is flagged, not guessed.
- What is left behind
- The position taken, the reason, and where it landed in negotiation. The next contract of the same shape starts from that, not from the playbook alone.
Getting from twenty interviews to a problem worth solving.
- Who is in the room
- Agents that transcribe, cluster and challenge; a facilitator who owns the framing. Divergence is cheap for agents and convergence is a human judgment — the tool should not blur which is which.
- What gets checked
- Every insight carries the interview fragments it came from, so a cluster that sounds good and rests on one quote is visible as exactly that. Concepts are checked against the constraints that were agreed up front.
- What is left behind
- The problem definition, the directions that were rejected, and why. Most design knowledge is lost in the second one; a canvas that keeps it is worth more than the deck.
A student investigating a question they cannot look up.
- Who is in the room
- A guide agent that asks the next question instead of answering, an evidence agent that checks whether a claim is supported, the student, and a teacher who can see the whole path.
- What gets checked
- A conclusion without evidence attached does not count as finished — the same rule the rest of this system runs on. The agents are configured to withhold answers, which is a permission setting, not a promise.
- What is left behind
- The reasoning is the artifact. A teacher reads the path — what was tried, what was discarded, where the student changed their mind — rather than grading a paragraph that could have come from anywhere.
Turning a month of numbers into a decision someone will sign.
- Who is in the room
- Agents that pull from the systems of record, build the model and re-derive it independently, plus the analyst who owns the assumptions.
- What gets checked
- The model is recomputed against actuals, and every assumption without a source behind it is marked as needing a human. An unproven number is allowed to exist; it is not allowed to be silent.
- What is left behind
- The definitions used and the judgments made become next month’s baseline, so the recurring argument about what a number means happens once.
Due diligence, or a market you have two weeks to understand.
- Who is in the room
- A research agent team working many sources in parallel, an analyst agent, a writer — and a consultant whose method is the thing worth keeping.
- What gets checked
- Sources are verifiable and the rejected ones are recorded with the reason. Knowing what was looked at and thrown away is most of what makes a finding trustworthy.
- What is left behind
- The method becomes an agent and a skill the client keeps running after the engagement ends. That is the difference between selling a report and leaving a system.
A routine process that crosses four systems and breaks in one.
- Who is in the room
- Agents granted exactly the tools the process needs and nothing else, plus the operator who owns the exceptions.
- What gets checked
- Every call happens inside an authorization boundary, is observed while it runs, and has a rollback path when verification fails. This is the case where the harness stops being a design principle and starts being the reason you are allowed to deploy at all.
- What is left behind
- Exceptions become rules. The fourth time the same thing breaks, the handling is already part of the workflow.
These are worked examples of how a unit of work is shaped in each discipline — not customer stories. We are early, and we would rather show you the shape of the thing than borrow credibility we have not earned.
“Use AI” is not a deliverable. A unit of work is.
A unit of work has a defined input, a defined output, a boundary someone answers for, and a way to be checked. That makes it something you can buy, verify, reuse and price — not just admire.
- 1Intentthe goal and its boundary
- 2Contextdata, knowledge, rules
- 3Agent teamplanner, expert, executor
- 4Workflowtools, hand-offs, state
- 5Validationevidence, evals, guardrails
- 6Outcomea business result, not a transcript
DeliverableIts inputs, outputs and responsibility boundary are written down.
VerifiableSomeone other than its author can check the result.
ReusableThe next case of the same shape reuses it instead of rebuilding it.
PriceablePriced per task or per unit of work, because the boundary is real. Seats are how you get in, not what the meter counts. Pricing by outcome only works where we run the work ourselves.
Three kinds of thing. Only one of them is a product you buy.
Not a feature list. What makes this a neutral work layer is open; what accumulates with you is what we sell. And a third pile most vendors never name: the machinery we run to keep it going, which you neither receive nor pay for.
And it is worth saying which layer this is a bet on. WorkspaceX sits in the AI workspace layer — the same one as Copilot, Glean, Lark and DingTalk — not the agent-infrastructure layer beneath it, which already has plenty of open projects. In this layer there is not one open option. That is what makes opening this a wedge rather than a ticket of entry, and it is why the repository is licensed Apache-2.0.
OpenThe neutral work layer
- The work-unit runtime
- Agent harness & evidence
- Context engine
- Model routing & adapters
- Sandbox & local desktop
- The work-unit format spec
SoldWhat accumulates with you
- Methodology & thresholds
- Evaluation sets & guardrails
- Hosted execution & quota
- SSO, audit, multi-tenancy
- Compliance export
- Marketplace & settlement (later)
Not deliveredOurs to run, never yours to buy
- Coordination plane
- Release & deploy console
- Incident board
- Agent fleet state
- CI metrics
- Key-rotation ledger
What happens when you stop paying
This is the question open source is actually for, and the one most vendors answer only in a contract you read once. Here is the commitment, and beside each line, honestly, how much of it is real today.
- The open part keeps working. Not a trial that expires. The work layer is yours to keep running, on your own machines, for as long as you want it. In force as a right: the repository is Apache-2.0. In practice, running it yourself still waits on a release and a one-command setup.
- Your data comes out whole. Everything you put in and everything the system produced, in open formats, without asking us. Partly built. Individual artifacts export today; one command for the whole workspace does not exist yet.
- There is a documented way to leave the hosted service. A stated path from hosted to self-hosted, with a checklist on both sides — not a support ticket and a shrug. Not built. Named in the plan, not yet designed.
- We do not switch anything off. No dark launch of a kill switch, no feature moved behind a paywall after you built on it. What is open stays open. In force. It is a rule about our own conduct, and the one line here that needs no engineering.
Whatever makes us a neutral work layer is open; whatever accumulates with you is sold. Naming the third pile is the honest part — it is how we run this, not something you are buying, and not something you should have to trust blindly.
12 — How this is built
WorkspaceX is built by agent teams, under the harness it ships.
We did not build an evidence system and then write features by hand. The repository is the proof: agents do the work, and the same gates this page argues for are the ones they cannot get around.
Read the repositoryThe contributor guide documents licensing, contributor sign-off and package checks. Read it in the repository before opening a contribution; setup and checks vary by package.
- No issue, no work.A feature that is not visible on GitHub does not exist. Development nobody can see is development only its author understands.
- An agent cannot mark its own work done.Only a verification script can move a feature to passing, and passing is irreversible.
- Evidence or it did not happen.Command output, logs, commits, screenshots. “It looks like it works” is not a state the system has.
- Merged, green, closed by a pull request.Code sitting on a branch does not exist for anyone else, so it does not count as finished.
The questions that decide whether this is deployable.
Where does our data live?
Wherever you decide. Cloud, your own infrastructure, a hybrid, or local-first on the machine itself — the same code runs in all of them, and deployment is a configuration choice rather than a cut-down build. Edition is a separate question from location: what the commercial edition adds is the governance layer above the work layer — single sign-on, audit, multi-tenancy, compliance export — and you can run that on your own infrastructure too.
What happens when we want to change models?
You change them. Models sit at the runtime layer, above your ontology and below your experience. Swapping a provider — frontier, domestic or fully local — does not touch how your organization’s knowledge is modeled, and does not invalidate the evidence already recorded.
How do we stop an agent doing something it should not?
Every action goes through the harness: an authorization boundary before it runs, observation while it runs, a verification step against a stated standard, and a rollback path when that check fails. An agent cannot reach a tool it was not granted, and it cannot record an outcome it cannot evidence.
Do we have to replace what we already use?
No — that is the opposite of the point. WorkspaceX connects to Microsoft 365, Google Workspace, Lark, DingTalk, Slack, GitHub and your systems of record. It is the layer where work runs across them, not a replacement for any of them.
Is this open source?
Yes. The repository is public and licensed Apache-2.0: you may run it, modify it and redistribute it. The LICENSE file is at its root, so you can check that rather than take our word for it.
What we sell is not a license to this code. It is what the Sold column above lists — hosted execution and capacity, organization-wide governance, methodology content: the parts that accumulate with you.
Do you train on our data?
No, and not as a setting you have to go and find. Your material is not training data by default, and using any of it would require asking you specifically and getting a specific yes — not a clause in terms you accepted once. This is a commitment rather than a feature, which means the honest way to hold us to it is a contract, and we would rather you asked for that than took a sentence on a marketing page as sufficient.
What does the free tier actually get?
The whole working product, with limited capacity — not a demonstration with the useful parts removed. The commitment we are designing to is that the free tier stays functionally complete and that running out of quota degrades you to a smaller model rather than cutting you off mid-task: a task that stops halfway is worse than a task that finishes less well.
What the paid tiers add is capacity, hosting we run, organization-wide governance (SSO, audit, multi-tenancy) and the methodology content — the Sold column above, in other words.
What happens to the junior people who do this work today?
The honest answer is that this depends on how you deploy it, and we have taken a side in the design. Human review is an explicit step in the loop — a named person, a recorded decision, and accountability that sits with them — which makes the junior analyst the reviewer rather than the replaced.
That is a real job and a better one, and it is also the only arrangement in which the evidence trail means anything: a chain nobody is answerable for is a chain nobody will defend. We will not pretend the question does not exist, and we will not tell you it has no downside.
What actually leaves the machine when we work locally?
Nothing, and it is enforced below the application rather than by our own good behavior. Local-only work runs inside a guard that patches the single call that every outbound network connection in the process has to pass through — so a vendor SDK’s telemetry, or an analytics beacon inside a transitive dependency, is refused exactly as our own code would be.
A machine on your own network counts as another machine and is refused too. The claim is deliberately narrow, because the narrow one is the true one: while work belongs to a local-only workspace, nothing leaves it. Outside that boundary a normal deployment’s traffic is normal traffic, and we are not going to pretend otherwise.
We have to run a security review. What can we ask for?
Today: the source, which is public and readable, and two audits you can run yourself rather than take our word for — a dependency license inventory and a scan of the history for committed credentials, both scripts in the repository.
Not today: there are no releases yet, so there is no signed release with a bill of materials attached, and no offline patch bundle for an air-gapped install. Both are commitments we have written down and neither exists, which is a more useful answer than a questionnaire response that implies they do.
What stage is it at?
Early, and honest about it. You can sign up and start on your own today — that door is open to anyone, and nobody is on a waitlist. Separately from that, we work closely with a small number of design partners who have real, verifiable, high-value work, and that one is a conversation rather than a form. Which of the two you want depends on whether you are trying the thing or betting a workstream on it.
Prove the unit. Then the team. Then the economy.
-
Now
High-value units of work
A small number of agentic work units, run end to end with real evidence, inside real organizations.
-
Next
Cross-functional agentic work
Ontology and memory spanning departments; agent teams with governance, and a marketplace for skills that travel between organizations.
-
Then
An open work runtime
Work units — not seats — as the thing that gets measured and paid for, on a runtime anyone can build on.
What “Now” does not include
A roadmap that only lists what is coming is a wish list. These are the things people reasonably expect at this point and will not get from us yet, said here rather than discovered in a call.
- A marketplace for skills. It does not exist. The developer portal is an internal operations window, not a storefront, and building the market is work that has not started.
- Selling this under your own brand. The name is hard-coded throughout the source. Making it a single constant is the prerequisite, and it has not been done.
- A partner or reseller program. No tiers, no certification, no deal registration, no partner sandbox.
- A community program. One narrow thing exists: a security disclosure channel. Contributing opens when a contributor guide and a fast local setup do. No forum, no office hours, no governance model.
- Anything for the people being assessed, beyond the baseline. When WorkspaceX is used to assess another organization — a supplier, an applicant — that organization gets disclosure, a route to correct and appeal, and no training on its data, from day one. A product experience designed for them does not exist yet.
Start where you actually are.
Four kinds of people arrive here, and each starts somewhere different. Find yours below; where a route is not open yet, it says so.
- You want to try it Sign up and open a workspace. No sales call, no waitlist. The moment that should convince you is not the tour — it is putting one real document in and getting back a conclusion with its source attached, so you can check it instead of believing it.
- You have to read it before you trust it Read the source. It is public. Find the block on outbound network traffic yourself rather than taking our word for it: local-only work is refused at the network layer, under the application, not promised in a document. The code is Apache-2.0. What is not ready yet is running it yourself — there is no release and no one-command setup. That is the same list as further up this page.
- Someone on your team already uses it Ask them to share the evidence trail, not a demo. Ask for a conclusion you did not watch being made, then check it yourself. If you cannot, that is your answer — and better to get it before your team depends on this than after.
- Someone sent you a result Nothing to install, nothing to sign into. You are the person most of this is for and the one least likely to ever open the product. Doubt one line and open it to its source. Everything above is worth nothing to you if it did not survive the trip into the document in your hands.