- Accumulated workRecords and grants stay in your environment when a model changes.
- Model connectionThe model is one replaceable part. Move from hosted to local and keep the rest.
- Your boundaryYou decide which specialists are admitted, and when admission closes.
Vision
01Sovereign IntelligenceSovereign Intelligence
Build intelligence
under your own authority.
Own the operating environment your agents depend on, from accumulated work and resource access to the relationships you choose.
Contents
Map this ownership boundary to your system
This is an architecture illustration. A real provider change requires adapter configuration, data-handling review, and behavior evaluation. Closing admission does not revoke outstanding grants or cancel in-flight work.
Your draft is saved only in this browser.
The value accumulates around the model.
A person or organization can build an intelligence system whose value accumulates under its own control. Research leaves reusable sources and findings. Engineering work leaves tested procedures and project knowledge. Relationships determine which specialists the system can call on. Much of this value lives in the operating environment around the model, and can remain when that model is replaced.
Whoever decides what the system can reach, whom it admits, and which actions wait for a person controls the system, whichever model answers. Sovereign intelligence means those decisions are yours.
Chio is a Rust kernel for agentic operating systems. It gives that environment an authority model independent of the model doing the reasoning. A governed call proceeds under a grant the kernel verifies, a guard can hold it for a person’s approval, and each decision is signed into a receipt. The application and host supply model connections, state, tools, interfaces, and operations.
A model is a connection you can change.
Your system retains its identity, resources, rules, and accumulated work when you replace a hosted model with local inference. The provider supplies inference; you retain control of the environment that uses it.
Changing models requires an adapter, a review of data handling, and evaluation against the job. The new model may behave differently. What should not change is the path every effect takes. While the application routes effects through the kernel, the grants, guards, and receipts that governed the old model govern the new one.
Moving to another host is a larger transition. The application state and the verification material it needs have to move, the destination’s trust configuration has to be established, and credentials, storage, and operations have to be arranged. An identity or an exported key alone does not move an operating system.
The useful question is specific: which part can you change, and which decisions remain yours?
Cooperate through a boundary you still own.
An owned system can be deeply connected. It can ask a specialist to inspect an approved document, join a shared research effort, or call a service another company operates. Each relationship needs a defined handoff, and every handoff contains three separate decisions.
The sender decides what to disclose. The sender also decides which authority to delegate, and a delegated grant can only narrow: the contributor receives what the work needs, never every privilege the requester holds. The receiver owns its tools and decides whether to admit the sender at all. Because the decisions are separate, each can be inspected, revised, and ended on its own.
Ending a relationship is three operations, not one. Closing admission refuses new connections at the edge. Revoking outstanding grants denies the calls they would still authorize. Cancelling or reconciling in-flight work settles what was already running. Each has its own control, none of them recalls information already disclosed, and the record of what happened remains.
Recognition is not admission.
A Chio DID names a key. Proving control of that key lets a peer complete a handshake; it does not oblige anyone to work with it. Recognizing an identity and admitting it are separate decisions, and the second belongs to the receiver.
Signed credentials let an actor arrive with an inspectable history. A passport carries issuer-signed statements, and the destination evaluates the issuer, the claims, and the supporting evidence under its own policy. The receiver decides whether to accept the portable record.
In federation transport the two decisions happen at two different moments. The QUIC handshake authenticates the dialer’s key. Then, before any protocol handler runs, an admission gate looks the key up in an issuer-signed directory that the receiver verified when it loaded it. A key bound to an admitted kernel passes, and the handler can resolve which kernel is calling. The gate refuses every other key with 403, even after a successful handshake.
alice is bound in the directory: the gate accepts, the handler runs once, and the reply is pong. mallory is authenticated but not bound: the gate rejects with 403, not admitted, and the handler never runs.
In Rust · admission.rs:11116 lines
pub fn decide(&self, endpoint: &EndpointId) -> AfterHandshakeOutcome {
match self.directory.load().authorize(endpoint) {
Some(_kernel_id) => {
// OBSERVE-ONLY: count the admit alongside the unchanged decision.
crate::metrics::record_admission(crate::metrics::ADMISSION_ACCEPT);
AfterHandshakeOutcome::Accept
}
None => {
// … count the reject, warn with the endpoint's short id
AfterHandshakeOutcome::Reject {
error_code: NOT_ADMITTED_ERROR_CODE.into(),
reason: NOT_ADMITTED_REASON.to_vec(),
}
}
}
}
Ownership gives cooperation a durable foundation.
A system that can choose its models, control its resources, and refuse or end a relationship has a position from which to cooperate. It can evaluate a contribution on its own terms and keep a signed record of what it decided.
Sovereign intelligence keeps these choices with people and organizations as the technology changes. Markets for agent work need buyers and sellers who can each say no.
Start by naming the owners in your own architecture. The worksheet under the opening drawing turns that decision into a note you can keep.
Admission opens a connection, and nothing more.
The gate decides once, at the handshake. Frames that arrive afterward still pass per-frame verification, and the work they request is still decided by the receiving kernel; the gate refuses unlisted peers before either check. Closing admission does not revoke grants or cancel work in flight, and no control recalls what was already disclosed.
The recorded run uses deterministic keys, loopback addresses, disabled relays, and a fixed directory clock. A deployment needs fresh keys, maintained directory trust, and explicit discovery and relay configuration. Changing models remains engineering work: Chio keeps the authority boundary in place while you do it, and does not make two models interchangeable.
Make it yours
Build a personal agent networkWhat to build
Choose the owner of each resource
before connecting another agent.
Start with your ownership note. In the personal-network example, identify the owner of each resource and the inputs a specialist receives. Keep the resulting handoff and its admission decision with your note.