Agents

CoeOS has no external “agentic engine”: agency is native to the application. It rests on two complementary mechanisms.

• Agents — a primary assistant (Nemo) that delegates to specialised sub-agents, each with a role, tools and guardrails.
• Workflows — deterministic pipelines with compartmentalised steps (compose → review → validate) for document reviews, with a mandatory human gate.

In both cases, no agent “contains” a model: it points at the CoeOS meta-model, and it is the box (the router) that sends each call to the model proven best for that skill. You choose the function, CoeOS chooses the model.

1. What an agent is

An agent is a function, defined by:

Element	Role
Name / label	Identifier and display name
Mode	primary (holds the conversation) or subagent (reachable only by delegation)
Base prompt	What defines its behaviour
Model	CoeOS by default (the box routes) — overridable
Allowed tools	Fail-closed allow-list (the agent can do nothing outside its list)
Step budget	Cap on turns for a delegated task

Agents are configured in Settings › Agents: you can edit the built-in agents (disable them, never delete — they are re-seeded on every deployment) and create your own (Markdown import/export). A personal agent takes precedence over the instance agent of the same name.

2. The built-in agents

Eight agents ship and are available out of the box.

Nemo — the primary assistant (primary)

The agent you talk to. It holds the conversation and delegates specialised work through the task tool. Use it by default — it is the entry point.

Explore — research (subagent, read-only)

Gathers facts: memory, RAG (document bases), workspace files, web, MCP servers. Strictly read-only — never creates, modifies, sends or deletes anything. Use it to find a past decision, compare sources, gather material before drafting.

Writer — drafting (subagent)

Produces complete long-form documents (reports, notes, syntheses) as files. “You write files, you don’t chat.” Use it when the deliverable is a document, not a chat reply.

Ops — bounded execution (subagent)

Runs precise, scoped actions on connected sources (Notion, Linear, infra via MCP). “Never widen the scope.” Use it for an explicit, delimited operation on an external tool.

Legal review — single-pass contract review (subagent)

Takes a document plus a doctrine, produces a strict JSON compliance table (FR and NL). Invariant: “You are NOT a lawyer… you propose a reading that the lawyer validates” (AI Act art. 50). Note: the current, richer version of this use case is the contract-review workflow — see §6.

Arena — adversarial review (three sub-agents)

A trio orchestrated in sequence to stress-test a document:

• Arena — Defence: argues for compliance, cites only clauses that are present.
• Arena — Attack: raises weaknesses citing clauses; must never invent a missing clause (marks it [clause absent from the document]).
• Arena — Synthesis: weighs defence vs attack, arbitrates, marks the result as a “proposal — final decision = the lawyer”.

Use it when you want an adversarial reading, not a single opinion.

Invariant across all legal agents: “zero invented source” and “the AI advises, the lawyer decides”.

3. How agents run

You talk to Nemo. When a task deserves a specialist, Nemo calls the task tool, naming the sub-agent, the instruction and a description. The system:

1. creates a child conversation dedicated to the sub-agent (with its prompt), and places a task card in the main conversation;
2. runs the sub-agent in a bounded turn, with only its allow-listed tools (fail-closed refusal otherwise);
3. returns a summary in the card, inspectable through the Trace panel.

Guardrails: at most 3 delegations per turn, delegation depth ≤ 2, a global budget of 30 steps. A sub-agent sees nothing of the parent conversation — the delegation instruction must be self-sufficient. Sub-agents do not clutter the sidebar and do not write memory.

Agent mode (agentMode) is off by default: without it, the conversation is a plain, clean chat (no tools injected). Turn it on to give the agent access to its tools: search (rag_search, web_search, web_read), files (fs_*), skills (skill_*), third-party MCP tools, and bash (sandbox). On a Mac with a connected local agent, bash and fs_* run on the user’s machine.

4. Agent Trace — “show your work”

An Agent Trace is the inspectable record of what an agent did. Two surfaces:

• The Trace panel (user) — opened from a task card, it shows the sub-agent’s full transcript: each step, each tool called, the result. Answers “what did this agent do, exactly?”.
• The Traces page (admin) — telemetry per agent and per call type (LLM / tool / task): call count, tokens, average duration, errors, plus the last 50 tasks. Rolling 30-day window. Answers “how do the agents behave over time?“.

5. Agent vs workflow

	Agent	Workflow (cowork)
Nature	autonomous agentic loop, tools, delegation	fixed deterministic pipeline, no tools or autonomy
Steps	free (up to budget)	three fixed: compose → review → validate
Context	the agent manages its context	compartmentalised: each step sees only the previous
Decision	the human validates sensitive actions	mandatory human validation before export
Use	research, drafting, operations, chat	regulated document reviews (contract, HR)

6. A worked workflow — contract review end to end

The contract-review workflow is a pipeline in three compartmentalised steps, each a near-deterministic LLM call (temperature 0.1).

1. Upload: the lawyer uploads a contract (text extracted by Docling/in-app; the binary never reaches the pipeline).
2. Compose: reads the document + the firm’s doctrine (the “Golden Rules”, GR-001…GR-012) → produces a JSON compliance table (one row per rule; absent clause → not_applicable, no invented excerpt, no cited case law).
3. Review: re-reads only the document + Compose’s output → corrects (missing clauses, invented excerpts, wrong severity or page) and logs the errors found.
4. Validate: sees the document + Compose + corrected Review → produces the final stable table plus a ≤ 5-line executive summary. It does not decide: it presents a stable state the lawyer will accept, reject or send back.
5. Human gate (mandatory): the output is a proposal. Export is possible only after the lawyer clicks “Validate” — that click writes an auditable workflow.validated event. Without it, export returns an error (409).
6. Export: once validated, the compliance table + the summary are exportable.

Compartmentalisation (compose never sees the reviewer’s notes, the reviewer never sees the validator’s summary) is precisely what stops the agent from validating itself. A second workflow, hr-policy-review, reuses the same engine for HR compliance (company policy vs Belgian sector CBA, CBA 200/100).

---

In one sentence

You talk to Nemo, who delegates to specialised sub-agents (Explore, Writer, Ops, Arena…) under guardrails and allow-listed tools; regulated reviews go through compartmentalised workflows with a human gate; everything is traceable (Trace panel + admin page); and models all come from the box, never pinned in the agent. The AI advises, the lawyer decides.