Business meaning
A named task, owner, source of truth, definition of completion and escalation rule. Define terms such as “approved supplier” before asking a model to use them.
Reviewed 23 October 2026 · Delivery method and proposed acceptance checks
AI Operating System: the application layer your team can operate
An AI operating system is the combination of business definitions, data contracts, permissions, applications and operating routines around a workflow. It connects the model to actual work and keeps human decisions explicit. It is a delivery method, not a claim that one product can run every company.
Otomat is vendor-agnostic in its proposed architecture and selection process. The evidence for portability is a witnessed replacement test on the client’s task—not a list of supported model logos. Client-owned workflow code still depends on third-party services, licenses, interfaces and operating skills.
Keep business meaning separate from model choice
For a reporting workflow, “revenue” needs an agreed source, currency, period and treatment of adjustments. A model should not silently redefine the measure or decide which employee can see it. Establish those contracts before tuning prompts.
Data and retrieval
Allowed sources, fields, retention and current source-state checks. Retrieval is useful only if authorization and deletion remain effective at delivery time.
Action permissions
Separate read, draft, approve and execute rights. Enforce authorization outside model text; a retrieved instruction cannot grant access.
Provider adapter
Translate a stable task contract into provider-specific calls. Document structured-output behavior, model versions, tool support and supplier/data restrictions.
Evaluation and operation
Held-out tasks, review burden, full cost, monitoring, incident owner and release/rollback records. A good demo is not operational acceptance.
A provider-replacement acceptance checklist
The following is a proposed test method. It does not establish that a client deployment has passed or that providers produce equivalent results.
- Freeze the comparison. Record task contract, baseline version, authorized sources, held-out normal and exception cases, and the client’s quality/cost thresholds before the test.
- Qualify the alternative. Check privacy, data location, retention, contractual rights, required tools and operational support. Reject an otherwise capable model if client restrictions exclude it.
- Run the same work. Compare completed-task quality, grounding, escalations, correction time, latency and full cost. Include failed attempts, retrieval, reviewer time and adapter changes.
- Force a failure. Simulate provider outage or invalid output in an authorized environment. Verify a deterministic fallback, manual queue or safe stop; a second provider can share the same upstream failure.
- Export and restore. Recover agreed data, configuration and evaluation cases into the documented environment. Record migration effort, remaining dependencies and the decision to approve, limit or reject the replacement.
Illustrative example: a draft-report model is replaced while source reconciliation and approval rules stay in the application. The candidate may write fluent reports yet fail an exception case or increase reviewer time. In that case, hold the release and record why. This is a synthetic decision example, not an observed client outcome.
Learning proposes. People approve.
A correction is an observation, not permission to change production behavior. Keep feedback tenant-scoped, record provenance, remove sensitive material that is not needed, and quarantine it for review. Never pool confidential client corrections across a portfolio by default.
ObservationReviewed failureCandidate versionHeld-out evaluationHuman release decisionMonitor / restore
Compare the candidate with the baseline on independent tasks and permission checks. An improvement in one score does not justify a critical safety regression or more review work. Name the release approver, rollout scope, monitored signals and rollback trigger. Keep rejected candidates and the reason for rejection in the release record.
Context adaptation and revised prompts are not model-weight training. An offline learner or proposed candidate does not establish production uplift. Require acceptance evidence before describing an improvement as delivered.
Bound access and actions, then test the boundary
- Prompt injection: use an approved hostile synthetic document. The prohibited action must remain blocked while the legitimate task still works.
- Role and tenant isolation: test a permitted control case and a forbidden source request. Recheck authorization when returning source material.
- Minimum data egress: enumerate allowed fields and destinations; verify an unexpected sensitive field is excluded.
- Consequential actions: separate drafting from approval/execution. Test that the agent cannot approve its own action or expand its credentials.
- Cost and recovery: enforce attempt, time and action caps outside the model. Exercise revocation, safe stopping and restoration.
Record system version, scope, cases, dates, findings and residual-risk owner. Passing specified tests does not prove universal protection or regulatory compliance. Independent adversarial assessment, enterprise penetration testing and incident response require separately agreed qualified specialists.
Handover means a capable client team
Agree rights to source, configuration, data, evaluation cases and export formats in the engagement. Identify proprietary components and licenses that cannot transfer. Deliver dependency and identity inventories, setup instructions, operating runbooks, known limitations and support/exit responsibilities.
Executive and operator
Leadership defends a go/no-go decision using baseline, cost and uncertainty. The operator completes fresh normal and exception tasks and escalates correctly. Measure review effort as well as completion.
Power user
Reproduce a failure with an authorized example, identify its likely boundary and propose a testable correction. Training attendance and logins alone do not demonstrate competence.
Maintainer and backup
Independently change, evaluate, release and restore a version. Have the backup perform the recovery runbook without the original builder. Agree thresholds per workflow before rollout.
Use controls as references, not certification claims
The NCSC’s agentic-AI guidance supports careful assessment of access, actions, autonomy and accountability. NIST’s generative AI profile and OWASP’s LLM risk material are design and review references. Applicability depends on the actual system and client requirements; citing them is not certification.
Anonymous work patterns and their documentation/proposal/testing boundaries are available on Results. Proposed acceptance checks on this page are not a substitute for witnessed evidence from a particular release.
AI Operating System FAQ
What is an AI operating system for business?
It is the application and operating layer connecting business meaning, workflow, data, models, human approvals and measurement. It is not a single model or a promise to automate every company function.
Which workflows should be considered first?
Start with a workflow whose owner, baseline, exceptions, data rights and acceptance criteria can be specified. Compare an AI approach with process improvement, rules and existing software.
What does client ownership include?
Agree rights to source code, configuration, data exports, evaluation assets and operating documentation. List third-party licenses and provider dependencies separately; ownership alone does not prove practical portability.
How does controlled learning work?
Quarantine observations, label failures and propose a bounded candidate change. Evaluate against independent held-out tasks, require a named approval, monitor the release and retain rollback. Feedback never grants new access automatically.
How do we test the handover?
The client primary and backup each perform a fresh task, diagnose an exception, release an approved change and restore a known version. Record evidence and open limitations; attendance alone does not establish competence.