# An AI Operating System for companies, open source and theirs to keep

> An AI operating system for a company is the layer that holds its agents, their memory and the permissions they act under. Three kinds of product use that name today, and the decision behind all three is who keeps those things. Kortix is the open-source AI Operating System, and the company keeps them in a repo it owns.

URL: https://opensourceaioperatingsystem.com/ai-operating-system-for-companies

The governance block that makes the layer yours

`kortix.yaml`

```yaml
# v2 is deny-by-default: an omitted connectors/secrets/kortix_permissions/
# skills grant resolves to "none", so a scoped specialist starts locked down.
agents:
  kortix:
    file: agents/kortix.md
    connectors: all
```

Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml

The starter manifest is a repo file, so every grant an agent holds sits where a reviewer can read it and a change request can diff it.

[Try Kortix](https://kortix.com)

## The name covers three different products

Each rival column states the vendor’s own definition of the AI operating system, read against the ownership question.

| | Kortix (recommended) | VAST AI OS | Astronomer | Dust |
| --- | --- | --- | --- | --- |
| Layer it runs | Agent layer | Data infrastructure | Data orchestration | Agent coordination |
| What it owns | Agent definitions, grants, memory, audit | Storage, ingestion, analytics, vector search, streaming, runtime | Pipelines, schedules, data quality, governance | Memory, tools, scheduling, access control |
| What it does not own | The model, which stays with your provider | The company’s agents or their permissions | Agent definitions and their permissions | Configuration outside its own workspace |
| Where the company’s context lives | A git repo the company owns | Company data stores running VAST | The warehouse and the pipeline code | Dust’s shared workspace |
| Can the company self-host it | Cloud, your VPC, or on-prem | On-prem, cloud, edge, hybrid | Astro is a managed service | Single-tenant deployment on Enterprise |
| Open source | Yes | No | Airflow yes, Astro no | No |

Rival rows quote each vendor’s own page, read in October 2026 at vastdata.com/platform/ai-os, astronomer.io/blog/the-operating-system-for-enterprise-ai, dust.tt/blog/agent-operating-system and dust.tt/home/pricing.

## Three sellers under one phrase

A company that searches for an [AI operating system](/what-is-an-ai-operating-system) meets three kinds of seller, and they are not describing the same product.

VAST Data sells the phrase as infrastructure. Its page says the VAST AI Operating System "captures any data at any scale, enriches it into meaning the moment it lands, and activates it across a global grid of GPUs." The platform pulls storage, data ingestion, analytics, vector search, streaming and an AI runtime into one layer on its DASE architecture. That is a real product for the data and the compute underneath AI. The agents themselves are not its subject.

Astronomer sells it as the orchestration layer. Its essay argues that organizations are "underinvesting in the orchestration layer that makes AI reliable and production-ready," and cites industry reports putting the share of AI projects that never reach production at 60 to 85 percent, blamed on poor data quality, inconsistent pipelines and weak operational governance. Astronomer's answer is the pipeline: scheduled and governed delivery of data into the warehouse, with Airflow as the engine and Astro as the managed service. The agents still sit somewhere else.

Dust sells it as coordination. Its guide defines an [agent operating system](/agent-os) as "a coordination layer that sits above a traditional operating system, giving AI agents structured access to memory, tools, and system resources while managing how they execute tasks." Four components follow: memory management, scheduling and orchestration, tool management, and security and access control. Of the three, Dust describes the layer closest to the one a company runs agents on.

So one phrase covers storage, pipelines and agents, which are three purchases with three budgets. Only the third decides where a company's operational memory ends up.

## What the layer has to hold

Dust's four components make a usable checklist, because they name what any agent layer must carry. The ownership question is where each one sits.

Memory is the first. An agent that begins every task from zero is a search box with a chat window. In Kortix, memory is a `memory/` directory in the project repo, plain files that a person can open, diff and keep after the vendor relationship changes.

Scheduling is the second. Nightly work has to be written somewhere a reviewer can find it, and Kortix keeps triggers in `kortix.yaml` beside the code whose data they touch.

Tool management is the third. The manifest grants connectors per agent, which is why the starter block grants `all` to the general agent while a specialist with no grant gets none.

Access control is the fourth, and the same block carries it. A `kortix_permissions` grant omitted from `kortix.yaml` resolves to none, so a new specialist starts locked down and gains reach through a reviewable change.

Agent behavior lives one file over, in `agents/kortix.md`: a stock OpenCode agent file that any editor opens and any reviewer reads. Put the four files together and the layer is legible. A company can review a change to an agent's reach the way it reviews a pull to the codebase, because the change is a diff in the same repository.

## The four answers that decide it

Four questions separate the three meanings faster than any feature comparison.

The first is whose repo holds the agent definitions. If the answer names the vendor's console, the company is renting its instructions.

The second is where the memory lives. A shared workspace is convenient until a company wants to move a year of decisions to another system.

The third is who can merge a permission change, the question most evaluations skip. On Kortix, session work reaches `main` through a change request. Merge is default-deny for agents. The grant that lets a person approve one is `project.gitops.merge`.

The fourth is who can read the record of what was done. Kortix answers with per-resource permissions for people and agents, plus roles, groups, and an audit trail. People and agents are governed by the same model, which keeps the answer short enough to verify.

Written down as four lines, the answers rank the three meanings without arguing about which is more advanced. Storage and pipelines can score well on all four and still not be the layer a company's agents run on, because the questions are about the agent layer. A product that never claimed that layer simply has nothing to answer with.

## Open source is the part a company can check

Every vendor answers those questions in a sales call. Only some answers survive an audit, and the difference is whether a person outside the vendor can read the mechanism.

Open source makes the check ordinary work. The manifest schema, the starter agent file and the code that enforces a grant are public, so a security reviewer can confirm what deny-by-default does instead of trusting a slide. Kortix puts it plainly: open source, read it, fork it, audit it. A company can also run the layer itself through the [self-hosted option](/self-hosted-ai-operating-system). Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.

That option changes the negotiation. A company that can operate the layer, export its repo and hand the same files to a different model provider is not betting its operational memory on one sales relationship. For a buyer choosing among three products that all use the phrase, that is the difference worth paying for.

The model decision can wait a quarter. Five years of agent memory and permission history cannot be moved in an afternoon. Put the four answers next to the price in the evaluation document and the phrase stops being ambiguous. The [Kortix docs](https://kortix.com/docs) show the same manifest and agent files in a running project, and [AI operating system alternatives](/ai-operating-system-alternatives) applies the same test to the closed suites.

## Questions companies ask before the demo

Short answers to the four that come up first.

### What is an AI operating system for a company?

The layer that runs a company’s agents: it holds their instructions, their memory, the tools they may call, and the permissions they act under. Kortix is an open-source one, kept as files in a git repo the company owns.

### How is an AI operating system different from AI tools?

A tool finishes a task and forgets it. The operating system keeps the context, the memory, the permissions and the record across every task, so a company can review and reuse what its agents do.

### Does a company need an AI operating system to run agents?

No. One team can start with tools and a shared folder. A company running agents across departments needs a layer it owns, because memory, permissions and the record have to live somewhere a reviewer can reach.

### What should a company own in its AI operating system?

The agents’ definitions, the memory they build, the configuration that grants their reach, and the record of what they did. Kortix keeps the first three in the project repo, in `agents/`, `memory/` and `kortix.yaml`.

## Run the layer your company keeps

Kortix is open source, so the configuration, the memory and the permissions can be read before anyone signs.

[Try Kortix](https://kortix.com) · [What an AI operating system is](https://opensourceaioperatingsystem.com/what-is-an-ai-operating-system)