Build your own agent
An agent is a model, a set of approved skills, tools and a policy, applied to a scope — assembled by your own team.
Give this agent these skills, on these hosts, read-only, for four hours.
An agent object your team can review, change and retire, and a record of everything it did.
The composition
AgentModelSkillsToolsPolicyon a Scope
What each part decides
An agent is a model, a set of approved skills, tools and a policy, applied to a scope.
Each of the four parts is chosen, not implied. The model decides where the reasoning runs. The skills decide what the agent knows how to do. The tools decide what it can reach. The policy decides what it may change. The scope decides where, and for how long.
Skills are manifests, not prompts
Each skill is a versioned package. Uploads are checked before they install, every version is archived, and each workspace enables or disables each skill.
Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.
That written contract is what makes an agent reviewable by someone who did not write it — and what a security team can approve or refuse before anything runs.
The lifecycle of a skill
- Draft — written by the team that owns the work.
- Static validation — the manifest is checked before anyone reads it.
- Sandbox — it runs where it cannot reach anything real.
- Red team — it is attacked before it is trusted.
- Owner review — the team that owns the systems it touches signs it off.
- Security approval — the last gate before publication.
- Published — it appears in the catalogue and can be enabled per workspace.
Where it runs
Skills, workspaces and the host execution underneath them are what an agent is assembled from; the agent is the explicit object that carries all four parts together.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
Host investigations show the commands that ran, their exit codes and output, per host.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
Customer-hosted deployments use packaged deployment configuration. An offline deployment requires an accepted bundle, local model and disconnected installation tests.
Bring one question of your own.