# An open-source agentic enterprise platform owns the machine, memory and policy

> An open-source agentic enterprise platform is something a company installs and governs. Kortix is an open-source CompanyOS — your agents, skills, company memory, and connectors in one git repo you own. Any model, your keys, self-hosted or managed cloud.

URL: https://agenticenterpriseguide.com/open-source-agentic-enterprise-platform

## Three products, five questions a buyer can check

Each rival cell follows the vendor’s own documentation ([Claude Cowork](https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork), [Microsoft 365 Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-overview)); the Kortix column is what the repo shows.

| | Kortix (recommended) | Claude Cowork | Microsoft 365 Copilot |
| --- | --- | --- | --- |
| Open source | Yes | No | No |
| Where agents run | Each session has its own isolated machine and branch. | Anthropic’s cloud, or your own Bedrock, Google Cloud or Foundry account | Microsoft’s cloud, in the Microsoft 365 apps |
| Where skills and context live | Your git repo: `kortix.yaml`, agents, skills, memory | Your Claude account: projects, plugins and chosen folders | Microsoft Graph and Work IQ hold your work data |
| Who sets the policy | Approval gates you set. Off until you set them. | Auto by default; Manual asks per action; Enterprise defaults to Manual | Access scoped by user permissions |
| Self-host | Kortix Cloud, your VPC, or on-prem | No self-host | No; runs in Microsoft’s cloud |

## The starter manifest, as shipped

`kortix.yaml`

```yaml
# {{projectName}}: the Kortix project manifest. Agents, what each may use,
# triggers and sandboxes live here, committed beside your files.
default_agent: worker
skills: {}
agents:
  worker:
    permission: allow
    tools: all
    skills: all
    connectors: all
    workspace: { project_repository: true }
```

Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml

Committed beside the agents it governs, so the roster and the grants travel in the same diff.

## What a new project ships with

Two passages from the prompt the default agent runs.

### Agent prompt

`agents/worker.md`

```
You are **Worker**, the general-purpose agent of **{{projectName}}**.
My Kortix, the built-in agent people talk to, routes each task to the
project agent that fits it.
```

### Sandbox rules

`agents/worker.md`

```
You are hands-on: you read, edit, run, search, fetch, and ship. The
session you're in is an isolated sandbox — an ephemeral branch of
this repo, your own `/workspace` — so you can install, experiment,
and recover freely. Only what you commit + push survives.
```

## Three routes to an agentic platform

The open-source name in this category mostly belongs to frameworks. A framework is one of three routes an enterprise takes, and each route hands back a different bill.

**A framework.** CrewAI documents itself as a framework for building agents and crews ([CrewAI](https://docs.crewai.com/en/introduction)). LangGraph documents a runtime for stateful graphs of steps ([LangGraph](https://docs.langchain.com/oss/python/langgraph/overview)). You get orchestration code and a call to a model. Everything a demo leaves out stays yours: where each run happens, what it may touch, what it remembers, who approved it, and how the change reached production.

**A vendor service.** Salesforce sells Agentforce, and Google Cloud sells its Gemini platform. Both are managed, both come with a console ([Agentforce](https://www.salesforce.com/agentforce/), [Gemini platform](https://cloud.google.com/products/agent-builder)). Identity, storage and admin controls arrive wired, inside the vendor's cloud. That is real convenience. It also puts the policy, the record and the data in an account you rent.

**An open-source operating layer.** The third route is a running system you install. Agents are files in a repo. Every session gets its own machine. Policy is written down. Work lands through review. Kortix is this route, and the five checks a buyer should make apply to Kortix as much as to any vendor.

## What the repo shows a reviewer

The starter template ships a manifest of 35 lines, checked November 2026. Its path is `packages/starter/templates/base/kortix.yaml`. Two comment lines state the job: agents, what each may use, triggers and sandboxes, committed beside your files. `default_agent: worker` names the agent a session runs when nobody names one, so the default path appears in a diff. `skills: {}` is an empty registry, and each agent turns skills on with a grant of its own.

Under the manifest sits the worker block: a prompt file, `permission: allow`, and `tools: all`, `skills: all`, `connectors: all`. The starter is deliberately open. Narrowing it is the first change a company makes. The prompt is a markdown file in the same folder, and its first line names the agent and the project: "You are **Worker**, the general-purpose agent of **{{projectName}}**."

The folder layout is the rest of the argument. `packages/starter/templates/base/agents/` holds one file for one agent. `packages/starter/templates/managed/skills/` holds 20 skill folders, each with a `SKILL.md` and its scripts. `apps/kortix-sandbox-agent-server/src/harness/` is the boundary to whatever runs the model loop, with one adapter behind it. All three open in a browser, without an account.

## The machine, the memory, the policy

Start with the machine. "Every session boots an isolated Linux cloud computer with your repo and your tools already on it, on its own git branch. The session id, the sandbox id and the branch name are one and the same string." Those are [Kortix](https://kortix.com)'s own words. The detail matters because a shared runtime hides it: one working directory, one set of environment values, and a permission bug spreads between teams.

Memory outlives the session. The worker prompt says what survives: only what the agent commits and pushes. The starter keeps company memory in `memory/MEMORY.md`, a file the agents read and add to. A correction from last quarter becomes a diff somebody can read. Memory held in an account you cannot export is memory you cannot correct.

Policy is a file too. "You set allow, ask or block per action, and a rule can match on a glob, a regular expression, or the arguments of the call itself. Nothing is switched on for you: a project with no policy declared runs every action." The second sentence is the honest one. It is also why the first task on a new project is to write policy, not to admire the roster.

Claude Cowork answers the same question with a permission setting. Manual pauses and asks for approval on each action, and Auto keeps working without stopping to ask about every step. Auto is the default on Pro, Max, Ultra and Team plans; Enterprise plans default to Manual, and on Team and Enterprise an admin controls whether Auto is available ([Cowork permissions](https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork)).

Review comes next. "Session work reaches `main` through a change request, and merge is default-deny for an agent unless an admin grants it." The session opens the request. Merging it is somebody's decision, and the record of that decision sits beside the code.

None of this depends on Kortix's hosting. Kortix is open source, so a team can read, fork and audit it, and run it on Kortix Cloud, in its own VPC or on-prem, with any model and its own keys. The repo is the product. The cloud is one place to run it.

## Five checks before you believe the claim

Any vendor can write these words. Ten minutes in a repository separates the ones that mean them, and each of the five checks can be made from a browser.

1. **Agents as files.** Open the agents folder and read one file. A readable file tells a reviewer what the agent is instructed to do before it runs. A roster that lives only in a console is a roster you cannot diff.
2. **Policy in the repo.** Find the line that sets allow, ask or block, and the rule beside it. A policy held in a settings screen cannot travel with a change or be reviewed with one.
3. **A harness you can swap.** Look for the boundary between the platform and the code that runs the model loop. Then count the adapters behind it. A loop welded to one model server makes next year's cheaper model a rewrite.
4. **Credentials outside the machine.** Check where a connector token lives. A token written into the sandbox as an environment value can be read by any command the agent runs. One brokered server-side cannot be read that way.
5. **One commit that changes behavior.** Ask for the commit that narrowed an agent's scope or changed a default. Read the diff. It shows a change traveling through review, which a security page cannot show.

## The work open source does not cover

Open source removes a fee and adds an owner. If the stack is self-hosted, somebody has to run it, keep the repo clean, write the first policy, and sit in the review queue. In a 200-person company that is usually one to three people in platform or IT, plus the manager who owns each function's skills. Kortix Cloud takes the stack off that list and leaves the other three.

A vendor service takes all four off the list and keeps them in its own account. For a company with no platform team, that is a reasonable trade, and most buyers make it. The failure is making it by accident while telling the board the company owns its agent layer. Carry one question into a proof of concept: who owns the machine, the memory and the policy in year three, after the champion who ran the pilot has moved to another team.

## The four questions buyers ask first

### Is there any open-source agentic AI?

Yes. Kortix is open source: agents, skills, company memory and connectors live in one git repo you own. CrewAI and LangGraph are open source too, and what they ship is the code to build a layer with, where Kortix ships the layer.

### What is the best free agentic AI platform?

Free is the wrong axis, because the software is the cheap part. Machines, model calls, and the people who write policy and review work are what cost. Kortix is open source and self-hostable, so a team can start without a platform fee and pay for what it runs.

### What's the best agentic AI platform?

No ranking settles that, and a feature list will not either. Ask who owns the machine each agent runs on, where its memory is kept, and who can change its policy. A team that wants all three in its own repo can start with Kortix, the open-source CompanyOS.

### What are the top 5 open-source LLM models?

That question is about models, not the layer that runs them, and any answer dates quickly. Kortix works with any model provider with your own keys, so pick the model from its provider’s list and settle the layer separately.

## Start with the layer you would have to build anyway

One repo, one roster, one change request to review.

[Try Kortix](https://kortix.com) · [Read the source](https://github.com/kortix-ai/suna)