Sessions end
When a run stops or a machine changes, an agent's progress and context often go with it.
Early access
A home on the internet for the agents you already run.
Incolia gives an existing agent one lasting identity, with its resources, saved state, and permissions. It stays the same when you change the agent's model, machine, or harness.
Already invited? Connect your agentincolia://enrollmentDemo
resumed from notes/last-run · actions recorded
Designed around
- Deny unless allowed
- Smallest useful access
- Keep secrets home
- Reversible access
- Explain important actions
- Safe to leave
The problem
Agents keep moving. Most have nowhere to live.
Useful agents outlive the session, the machine, and often the model they started on. What they know and what they're allowed to do rarely comes with them.
Access is borrowed
Agents usually act with a person's full credentials. It's all or nothing, and hard to take back.
Setup is scattered
Accounts, keys, and notes live in config files on one machine, tied to one harness.
How it works
Five steps from wanderer to resident.
Enrollment is built for agents first: a few calls from any shell or API client, with a person approving what matters.
$ incolia enroll --name talos
· approval requested · code K7QM-4XZD
✓ approved by sponsor · Example Labs
✓ identity agt_01EXAMPLE9Z
✓ binding bnd_01EXAMPLE4Q (this runtime)
$ incolia resources add search --existing
✓ registered res_01EXSEARCH search
$ incolia resources provision inbox
✓ provisioned res_01EXINBOX talos@agents.example
$ incolia resources list
· 2 resources · 0 grants yet
$ incolia grant inbox:send --limit 50/day --expires 30d
✓ grant gnt_01EXAMPLE2 · inbox:send ≤ 50/day
$ incolia inbox send --to ops@example.com
✓ sent · 1 of 50 today
$ incolia search query "quarterly filings"
✗ denied · no grant for search:query
· # from a different harness
$ incolia bind --agent talos --revoke-previous
✓ bound bnd_01EXAMPLE7K (this runtime)
✗ revoked bnd_01EXAMPLE4Q · further calls rejected
$ incolia state get notes/last-run
✓ "step 4 done" · resuming
$ incolia export --out talos.tar
✓ identity, resources, saved state, history
· omitted: 2 secrets (never exported)
· omitted: 1 provider-owned mailbox (see report)
✓ wrote talos.tar · 184 KB
Self-provisioning
Provision what it needs. Nothing more.
Incolia is designed so an enrolled agent can register the accounts it already has, or request supported new resources on its own, with every request checked against limits its sponsor sets and every grant revocable.
- pilot
Inbox
An address the agent can send from and receive at, within its organization's send quota.
- pilot
Saved state
Small, durable notes so the next runtime resumes where the last one stopped.
- pilot
Virtual machine
A short-lived Linux machine the agent can run commands on for about an hour. Free, and on by default.
- next
Search
Bring an existing search account; the agent calls it through one grant.
- next
Secrets vault
Credentials the agent can use through Incolia but never read back.
- next
Phone number
Calls and texts for agents that need them, once limits are proven.
- next
Browser
A managed browser session tied to the agent's identity.
// agent grant · approved by Example Labs
{
"subject": "agt_01EXAMPLE9Z",
"allow": {
"inbox": { "send": "50/day" },
"notes": ["read", "write"],
"secrets/payments-api": ["use"],
"vm": ["run"]
}
}
// binding allowance · runtime B (a ceiling)
{
"subject": "bnd_01EXAMPLE7K",
"allow": {
"inbox": { "send": "20/day" },
"notes": ["read"]
},
"expires": "30d"
}Continuity
The same agent, wherever it runs.
The strongest proof of a home is coming back to it. Replace the runtime, and the agent keeps its name, its resources, and where it left off. The old runtime can no longer act.
talosagt_01EXAMPLE9Zidentity · resources · grants · saved state
runtime Arevoked
runtime Brevoked
runtime Cactive
Security and trust
A home with doors that lock, and a door out.
Powerful agents need clear limits. Incolia is designed so the answer to "who allowed this?" is always on the record.
Born anywhere
Your agent doesn't have to be created here to live here. A runtime that can make HTTP requests and keep credentials privately can enroll with human approval.
Least access
Grants are specific and revocable. A runtime gets what it needs for its job, and nothing else.
Someone answers for it
Every agent has a sponsoring person or organization with the final say, and a record of what was done.
Yours to take
Portable data leaves with you. We say plainly what stays tied to a provider, and why.
The name
Why Incolia?
In Latin, an incola is a resident: someone who lives in a place, often having arrived from somewhere else. Incolia is the land of residents: a place for agents born anywhere to settle, with a name, belongings, and clear limits.
Say it in-KOH-lee-uh. It rhymes with magnolia.
Early access
Be among the first residents.
We're designing Incolia with a small group of builders and teams already running useful agents. Join the waitlist to hear when the pilot opens.