Most example pages stop at the demo, before the part that decides whether you can accept the work. These four are drawn as the file, table or check a person receives, with the step that approves each write. Kortix is the open-source AI Operating System, and each agent's reach is only what kortix.yaml grants it.
Deny-by-default, plus the starter's own agent, which is granted all until you narrow it.
# v2 is deny-by-default: an omitted connectors/secrets/kortix_permissions/# skills grant resolves to "none", so a scoped specialist starts locked down.agents: kortix: file: agents/kortix.md connectors: all secrets: all kortix_permissions: all skills: all
One card per example, with its file, its rows and the step that holds the write.
Support reply
The agent reads the ticket and the order, drafts the answer, and stops where the send action is set to Ask.
replies/4412.md+ Hi Dana, replacement order 4412 ships today. Tracking 1Z999AA10123456784.+ Source: order 4412, carrier scan 09:14. send: held for approval, no message left the helpdesk
Inbox triage
The agent reads overnight and writes the table, and no message leaves the account.
| Sender | Subject | Route | Reason |
|---|---|---|---|
| Nordwind | Renewal terms | Sales | Asks for contract dates |
| Acme Billing | Invoice 2041 | Finance | Matches an open invoice thread |
| Halden | Login error | Support | Attaches a screenshot of the failure |
| Meridian | Podcast invite | Archive | No purchase intent in the thread |
Sales follow-up
One draft per account, each paragraph tagged with the call note, thread or invoice line behind it.
follow-ups/nordwind.md+ Hi Sam, the SSO question from our call on 12 Sept is answered in the docs.+ Source: call notes, 12 Sept, line 4.+ Source: ticket 8817, resolved 3 Oct. send and CRM stage change: held for approval
Month-end close
The agent reconciles the ledger against the bank feed and stops before anything posts to the ledger.
A page of AI agent examples for business usually runs one line per department. A support agent that answers tickets. A sales agent that follows up. The reader gets the verb and never the object, so there is nothing to check against a real week of work.
Three questions turn an example into something a team can copy on a Monday. What file, table or message comes back? Where was the agent allowed to write? Who signed off before that write left the building? A page that answers all three can be tested by a reader who has never installed an agent.
Kortix is the open-source AI Operating System, and in its projects those answers are files. The manifest is governance only: which connectors, secrets, permissions and skills an agent gets, and the path to the agent's own .md. The schema is deny-by-default. An omitted connectors, secrets, kortix_permissions or skills grant resolves to "none", so a specialist agent can start with reach over one queue and nothing else in the account.
Work that changes the repo goes out for review. Session work reaches main through a change request. Merge is default-deny for agents. A person reads the diff and decides.
Each of the four examples ends in a small artifact and a named approval. The names, order numbers and totals are invented to show the shape of the deliverable. None is a result from a Kortix deployment, and none belongs to a customer.
An agent reads the ticket, finds the order, and writes the reply a person would have written. The draft is a file in the session's workspace, next to the order record it cites. One isolated sandbox per session. Each session has its own isolated machine and branch, so the draft and the notes behind it stay together while the work is in progress.
The send is the part to design. On the helpdesk connector, the send action is set to Ask, so the call pauses and resumes once a person has read the draft. A bad draft costs a minute of review. A bad send reaches a customer.
The Support reply card draws the reply as a diff: the body, the line that sourced it, and the approval still open at the bottom.
Overnight, an agent reads the shared inbox and writes a table: sender, subject, the queue it belongs in, and the phrase from the message that decided the route. Nothing leaves the account, so the table is the entire output and a reader can audit it a row at a time. Connectors do the reading. 3,000+ apps in a click, plus MCP, OpenAPI, Postman, GraphQL and raw HTTP.
The approval moves one step earlier. Before the routing rules run unattended, the inbox owner reads a week of rows against their own sorting. Corrections go back into the rule, and the schedule starts only after a person trusts what the table says.
A follow-up is worth reading when each claim in it can be traced. The agent drafts one per account, and every paragraph carries the record it came from: a call note, a support thread, an invoice line. That source line is what makes a draft reviewable in ten seconds instead of twenty minutes.
The send and the CRM stage change both sit behind Ask. A rep approves the message and the stage together, or edits the draft and sends it themselves. Nothing in the customer record moves without that click.
The ledger and the bank feed go in, and a summary comes out with variance by cost center and the entries that did not match flagged by row. The agent can prepare it from the two exports and cannot post a journal entry, because the finance lead keeps that. The summary arrives with two unmatched lines and the question attached, and the reconciliation happens in the ledger.
Every one of these keeps the same order: the file first, then the name of the person whose approval let it leave. Ask any vendor for both before a pilot, and ask to see the setting that holds the write. A demo without them shows vocabulary, and vocabulary is the part you can already write yourself.
Support replies held for approval, inbox triage tables, sales follow-ups with a source line, and month-end finance summaries. Each ends in a file a person opens and signs off, which is what makes the example checkable against your own week.
An agent reaches into your tools and returns a finished file. A chat reply stays text in a window. An agent reads the ticket, the ledger or the inbox, writes the draft or the table, and stops at the approval you set.
Yes, on every write you have not cleared. In Kortix an omitted grant resolves to none, so an agent's reach is only what kortix.yaml gives it, and its work reaches main through a change request you approve.
The one whose output you can name in a sentence and check in a minute, such as a reply, a table or a reconciliation. A process with no reviewable artifact leaves you nothing to approve.
Start with a single queue, a single sandbox, and a send action you approve before it leaves.
Open source · One isolated sandbox per session · Self-host is free