Investor information
The personal AI agent
your family controls.
Operator is built around an immutable Safety Core, a calibrated Trust Engine, and a household-shaped principal model. Every limit is codified in the architecture — not promised in a policy document.
The thesis
The OS-displacement layer is the agent, not the app.
For thirty years the operating system organised your computer. For the next thirty, the agent organises your life. The shift is not which app you open — it is whether you open one at all.
Today you run thirty apps for the work of one human. Mail in one place, calendar in another, brokerage in a third. Each one demands its own login, its own mental model, its own attention. The agent collapses that surface. One context. One memory. One place that knows what you asked for last week and is still working on it.
The harder half is trust. An agent that can act on your inbox, your calendar, and your money is an agent that can also misfire, leak, or be talked into something it should not do. Most teams answer this by asking permission every time — which makes the agent useless — or by saying nothing, which makes it dangerous. Neither is the answer.
We do it the way an executive officer is supposed to be empowered: with real authority where it is granted, bounded everywhere it is not, and the boundaries published in advance. The Trust Engine scores every action against your calibration. The Safety Core holds five controls that no prompt, no model swap, no automation path can move.
Competitive moat
Four properties.
All defensible. None copied.
These are not features. They are architectural commitments made at the beginning of the build — when changing them was cheap. That window is closed.
-
Adaptive trust score
Every action is scored in real time against a per-principal calibration. Authority is granted where you set it and bounded everywhere you have not. The score updates as your preferences change — without a configuration UI.
ADR-011
-
Cross-domain causal explanation
The agent explains, before it acts, what it is about to do and why — across domain boundaries. An email reply that rearranges a calendar block and triggers a financial hold is explained as a chain, not three separate events.
ADR-018
-
Tier-graduated autonomy
Four autonomy tiers — monitor, advise, execute-with-approval, execute — set per domain, per principal, per context. The agent never selects its own tier; the principal does. The Safety Core enforces the boundary.
ADR-002
-
Family delegation
A family is not a single user. Spouse, children, household staff — each is a principal with their own authority model, their own memory, their own consent surface. Most competitors will not catch up for years; not because the model is hard, but because the architecture is. We started there.
ADR-046
Architecture
Three layers. One agent. Limits codified in advance.
Each layer is a separate ADR; each layer is replaceable; each layer is observable end to end.
Full interactive architecture diagram
-
Authority
Trust Engine
Per-action authority scored against your calibration. Real autonomy where you grant it; bounded everywhere you do not.
ADR-011
-
Edict
Safety Core
Five immutable controls — authority bounds, approval gates, audit trail, reversibility, provider independence. Codified in the architecture, not in any one model.
ADR-018
-
Office
Capability dispatcher
Routes per request to the right capability across a twelve-domain surface, frontier-routed by model. Claude today; whoever wins next quarter, tomorrow.
ADR-002
Honest about phase. Voice, camera, chat, and the single-principal Trust Engine ship today. Multi-principal household tiers, the full twelve-domain dispatcher, ambient surfaces — on the roadmap, not in v1. The architecture is built so they slot in without a rewrite.
Safety model
Every limit, published in advance.
Trust Engine
The Trust Engine scores each action against your calibration before Operator moves. Scoring is per-principal, per-domain, per-context. An action that is approved for you is not approved for a household member until they set it.
The score is not a model output — it is a deterministic authority check run before the model is ever invoked. No jailbreak prompt changes the score.
ADR-011
Safety Core
Five controls that no prompt, no model swap, and no automation path can override: authority bounds, approval gates, audit trail, reversibility, and provider independence. They are enforced at the infrastructure layer — not by asking the model to behave.
Provider independence means the Safety Core works the same whether the model is Claude, GPT-5, or whatever wins next quarter. The edict is the architecture, not a policy document.
ADR-018
Round opening
Get notified when we open.
Leave your email and we will reach out personally when the round opens. No drip sequence. One message.
Or reach out directly at hello@operatorhq.link.