Agent Workstation Platform
Persistent AI-operable desktops with a fail-closed permission engine, approval queue, and always-on flight recorder.
Problem
Giving an AI real hands — a browser, a desktop, a shell — is either reckless (full access) or useless (no access). Organizations need a middle path with human control and a complete audit trail.
Solution
A workstation engine deployed to a fleet of VM nodes — 53 MCP tools, an Anthropic-standard computer-use executor, and a permission engine where every action is allowed, asked, or denied by version-controlled policy, with approvals pushed to a human's phone.
Architecture
This is the infrastructure answer to “how do you let an agent actually do things.” The design principle ladder — DOM semantics first, vision second, desktop control third, shell last — keeps the agent on the most observable, least dangerous rung that can do the job. Everything consequential pends for a human; everything, without exception, writes an audit row; and the DVR means any approval can be judged with full context of what the agent just did.
Repo evidence
- 53-tool MCP server + Anthropic computer_20251124 executor, deployed on three nodes from one engine repo
- Permission engine — allow/ask/deny from git-tracked policy, fail-closed when unconfigured; asks pend at zero token cost until a human decides via Telegram or dashboard
- Always-on DVR recording with intent-event sidecar and run→footage scrub viewer; approval cards show instant replay of the minutes before each request
- OAuth 2.1 + dynamic client registration front door for consumer AI clients; public endpoint via Cloudflare Tunnel