The primitives of an agentic operating system

There is a moment in every agent project where the demo works and the real work begins. The model is fine. The prompt is fine. What is missing is everything around the model: who the agent is, what it knows, what it is allowed to do, how you know it did the job, and what happens when it does not. Teams discover these one at a time, usually in production, usually at 2am.

We got tired of watching that happen and named the list. An agentic operating system needs eight primitives. Miss one and you will build it yourself later, worse, under pressure. What follows is the stack, and the evidence that other frameworks are quietly converging on the same eight under different names.

A framework is a bet on which primitives you will need. Most bet on the model and lose on everything else.

Identity

An agent has to be its own actor, with its own credential, its own permissions, its own line in the audit log, and a human owner behind it. The alternative, which almost everyone ships first, is an agent wearing a person's access token. That one shortcut makes attribution, revocation, and least-privilege impossible at the same time. Identity is the substrate every other guarantee rests on: you cannot measure, gate, or reverse the actions of a thing you cannot name. This is no longer a fringe view. The identity products shipped in 2026, Microsoft Entra Agent ID, Okta's Cross App Access, and Auth0's Auth for GenAI, all converge on the same primitive: an agent is a non-human identity that gets its own OAuth credential and a scoped, revocable grant, not a borrowed human session.

Context

The context window is working memory, not memory. A useful agent needs a durable, queryable body of knowledge, connected to your data, accumulating from experience, retrieved selectively. The window keeps tripling in size and that is genuinely useful, but a buffer that empties between sessions was never the thing people meant by "memory." Every serious framework ends up rebuilding this distinction. LangGraph splits it explicitly into checkpointers, which persist a single thread's state, and stores, which hold long-term memory across threads. OpenAI's Assistants API calls the same idea a thread. The accumulated record of what worked is the only part of the system that gets better on its own, and it is the part almost nobody builds deliberately.

Execution

Agents that only talk are demos. Agents that do real work need somewhere to do it: sandboxes, databases, object storage, tools, and a way to ship, deployments included. This is the unglamorous half of the platform and it is where most of the operational surface lives. The pattern is visible everywhere: OpenAI's code interpreter runs model-written Python in a sandbox that iterates until the code succeeds, and the Model Context Protocol has become the de-facto standard for handing an agent the tools it acts through. An agent that can reason but cannot run code, hold state, or deploy is a very articulate bystander.

Coordination

Real systems are more than one agent, and more than only agents, because humans are in the loop too. The instinct is to have agents talk to each other, and that is exactly where cost accumulates and reliability degrades quietest. A 2025 study that annotated more than 200 execution traces across seven multi-agent frameworks found that most failures traced not to model capability but to system design and inter-agent coordination, roughly two fifths to specification and design, over a third to coordination breakdowns between agents, and the rest to weak verification. The durable pattern is shared state: a work log everyone reads and writes, so coordination survives any single participant dying. Kill a worker at random; if the work continues and the record still explains itself, the design is sound.

Proof

Passing a benchmark once tells you a system could do the work on a Tuesday. It says nothing about whether it still does the work this week. Proof is continuous measurement against a standing objective, with the evidence kept: reliability as a trend, not a launch-day screenshot. In our own testing, decomposing a task across coordination patterns, adding agents did not lift accuracy on well-specified steps. A single capable model found every planted issue. The value of running several models was never accuracy. It was a calibrated reading of when to trust the answer.

Controls

Autonomy is not a property of a system; it is a property of a task within it. The useful question is not "should a human be in the loop" but "which loop, on which task, and at what cost." Sort work by how hard it is to undo, not how important it feels. Most of what an agent does all day is reversible, and treating it otherwise is how oversight gets spent in the wrong place. The brake matters more than the gate: a strong stop-and-reverse lets you afford a looser front door.

Sovereignty

Every serious operator eventually asks two questions about their agent stack: who can switch this off, and can I take my data with me. The answers are architectural, and usually decided long before anyone thinks to ask. An agent stack holds your credentials, the record of how your work is done, and the audit trail that proves it. That is not a thing to rent without an exit. Run it on our infrastructure, or on yours, the same application either way.

Self-improving

The last one is the payoff of the other seven. When identity makes actions attributable, proof measures them, and context stores what worked, the system has everything it needs to get better from every iteration. Models improve on someone else's schedule; a corpus of your own outcomes improves every time you run. That corpus is the asset, the thing you actually own when you build on someone else's model. It is also the least standardized primitive on this list, which is exactly why it is the one worth owning.

How we think about it

These eight are not a menu; they are a spanning set. Drop one and the gap does not disappear, it just moves into your incident channel. The table above is the argument in miniature: every framework worth naming has independently rebuilt some subset of this list, under its own vocabulary, usually one production incident at a time. Recursiv is the platform that ships all eight behind one API: identity, context, execution, coordination, proof, controls, sovereignty, and the self-improvement that falls out of having the first seven. You can build them yourself. We did, so you do not have to.