Always-on agents on machines you control

An always-on agent is useful when work arrives outside a browser session: a sales manager asks for account context in Telegram, an operations lead forwards an exception, or a scheduled role prepares the morning queue. It becomes dangerous when “always on” means a bot can execute arbitrary shell commands with ambient credentials.

Neuro OS channels separate conversation from execution. The channel receives an event, resolves a role and project, and starts an isolated sandbox on infrastructure the company controls. The role gets only the mounted skills, memory, and connector permissions required for that request.

Choose the operating boundary

The runtime can live on a company VPS, private cloud, VPC, or internal machine with controlled outbound access. Select the boundary from data sensitivity, availability, support capacity, and model requirements. Self-hosting improves control; it does not remove the need for patching, backups, monitoring, and incident ownership.

Keep the channel adapter small. It should authenticate the sender, map identities to roles, enforce message and file limits, and hand work to the runtime. Do not place business logic or permanent secrets inside a Telegram bot process.

Treat every request as untrusted

Messages and attachments may contain prompt injection, malformed files, or requests outside the sender’s authority. Parse files in a sandbox, cap resources, and block host filesystem access. Credentials never enter the sandbox. Approved connectors expose narrow operations through a broker and record what was called.

Apply Allow/Ask/Block at the operation level. Reading an approved status table may be Allowed. Drafting a reply can be Allowed within the workspace. Sending that reply, updating Bitrix24, or restarting production defaults to Ask. Exporting secrets or running arbitrary host commands is Blocked.

Make approval usable

An Ask card should state the actor, target, exact change, relevant evidence, and rollback path. “Allow tool use?” is not enough. For a CRM update, show fields before and after. For a message, show the final recipient and text. Approval expires and applies to that transaction, not every future request in the channel.

The human on writes is part of the product design, not friction to hide. Low-risk read and analysis work can remain fast while consequential actions stay accountable.

Keep models interchangeable

Use the model that fits the task and policy: a strong hosted model for difficult synthesis, a regional provider for residency, or an open-weight model for local processing. Bring company-approved API keys through the runtime’s secret store. Skills and project memory remain model-neutral files, so changing inference does not erase the role.

Test fallback behavior. If the preferred model is unavailable, the role may use an approved secondary model, queue work, or stop. It should not silently send sensitive data to a new provider.

Operate it as a service

Measure queue time, completion rate, model and connector cost, approval latency, rejected writes, and sandbox failures. Set per-role budgets and concurrency limits. Use idempotency keys for scheduled work and external actions so retries do not duplicate messages or records.

Maintain a kill switch for a role, connector, channel, and model. Back up the repository and encrypted state. Review the execution trail for unusual access patterns, repeated denials, and instructions that need correction.

Start with one channel heartbeat

A practical first deployment is a daily read-only brief or an exception triage role. Give it one channel, one owner, and one source system. After two weeks, review usefulness, false positives, cost, and security events. Add writes only when the approval experience and rollback are proven.

An always-on company role should feel available without being omnipotent. The durable pattern is authenticated channels, isolated execution, narrow official connectors, explicit permissions, and people deciding consequential changes.

This work runs on Neuro OS. To scope a first role, get started.

Explore Neuro OS →