Agentic Workforce ME

A digital workforce you can see — and control.

Specialized AI workers, organized like your company. They meet people on WhatsApp, email, and the web. Your staff approve the important steps. Every action leaves a record.

Arabic and English Our cloud, yours, or inside your network People stay in control
01 / 16
agenticworkforce.me
The problem
02 / 16

Work is stuck. Tools pile up. Nobody can see the AI.

Today, three people push cases through tangled tools. With a workforce, one organized flow. TODAY — EVERY CASE BY HAND The person waiting answers change with the desk The organization penalty before explanation The officer the queue refills Chat box Inbox Spreadsheets Portal Case tracker many tools · no shared flow · no record organize it WITH A WORKFORCE — ONE FLOW Someone asks any door THE RIGHT WORKER on your org tree A person approves the job waits ONE TRAIL steps · cost · replay one front door · one job · one record

One root cause: every case is still handled by hand. Hiring into the same maze does not fix the maze.

The solution
03 / 16

An organized digital workforce — not another chat box.

Workers sit on your tree. Each one has a written role you publish.

Department, section, unit, worker — and the worker's written, published role. DEPARTMENT Finance tools · knowledge · rules flow down SECTION Accounts payable UNIT Operations the most specific grant decides WORKER Claims reviewer defined by a written role Claims reviewer WRITTEN ROLE — REVIEWED, THEN PUBLISHED Who they are persona and purpose What they know the documents you gave them Which tools they may use granted explicitly — nothing else When a person must approve the pause is written into the role PUBLISHED version 3 — immutable Published versions do not change under you. Improving one is a new version.
The platform
04 / 16

An org chart of AI workers. Human approvals. A full trail.

That is the whole product. Everything else is how you build, run, and inspect it.

01 · The org chart

Reporting lines you already know

Tools and rules flow down. The most specific grant decides.

02 · Human approvals

Sensitive steps wait for a person

Autonomy is granted, per team. It is not the default.

03 · The trail

Every job leaves a record

Steps, approvals, tokens, and cost — replayable on the job.

Build. Run. Measure. Then publish the next version.

How the platform is built
05 / 16

Work moves down. Control stays with you.

Five layers. Follow a request from the person to the record it leaves.

Agentic Workforce ME platform architecture 1 Channels — where people reach the workforce Message in A message arrives. Same rules on every door. WhatsApp message in Telegram message in Teams * message in Webhooks signed inbound Email inbox rules Web & portals site or widget Workspace staff pick a worker * Teams, Slack, SMS — with your provider credentials a request arrives 2 Who does the work Org tree + written roles AI specialists sit on your tree. Set in the console — not inside a chat. People stay outside the green frame. DEPARTMENT Finance SECTION Accounts payable UNIT Operations AI WORKFORCE WORKER Claims reviewer Crews one job, several workers assigned to the right worker 3 How work is controlled The trust layer Nothing important leaves without passing here. A person approves job pauses until they decide One door to your systems only the tools you granted Every step recorded audit, tokens, cost Each customer sealed they cannot read each other then, and only then 4 Connectors & knowledge sources — where tools and knowledge live Knowledge, tools, and keys — the model does not hold them Knowledge Files, storage, from the system. Allowed tools Built-in or connected. Unknown tools never reach the model. Databases SQL Server, Postgres, Oracle connectors. A write waits for a person. Keys stay here Unlocked only at the moment of use. Never in a prompt. 5 The factory that runs it A job you can pause and replay Front door API takes the request opens a job Job runners Run the job. Keep going if a machine restarts Engine Calls your model. Can pause until a person decides Sealed records One store. Each customer cannot read another

A person starts the work. The platform assigns it. The AI workers do only what they are allowed. Passwords never enter the model. A person still signs off on what goes out.

When work arrives
06 / 16

Someone asks. A ticket lands. The same path runs.

WhatsApp, email, a portal, or the workspace — one job, one trail.

A request arrives, is assigned, worked, paused for a named person, and recorded. 01 · ARRIVE Someone asks same front door, every channel 02 · ASSIGN The right worker published on your tree — or a crew 03 · WORK Your files, granted tools nothing else reaches the model 04 · PAUSE A named person decides approve · edit · reject · reply stays paused even if a machine restarts 05 · RECORD The trail stays steps · approvals · tokens · cost yours to replay open any job later
How the agents work
07 / 16

A planner, child runs, four gateways, one record.

How one request becomes a plan, child runs, governed calls, a human decision and a complete record.

A planner agent decomposes a task into typed subtasks that run as child runs against a shared blackboard, with an A2A hop to a registered external agent; every step passes the ModelGateway, the knowledge service, the durable checkpointer and the ToolGateway, parks at an interrupt for human approval, and writes runs, run_steps, usage_events and audit_log rows. 01 · RESOLVED BEFORE THE FIRST TOKEN Finance › Accounts payable › Operations manifest ∩ grants → EffectiveConfig frozen at run start · the most specific scope wins A run is created chat · channel · trigger a2a · workflow · crew runs.trigger 02 · PLANNER Decomposes the task into typed subtasks each subtask becomes a real child run — metered, audited, replayable no usable plan ⇒ each executor receives the whole task a2a:<slug>.<skill> — one tool step sync, or async with a push callback REGISTERED EXTERNAL AGENT An agent on another platform registered once, then addressed like any other worker task: submitted → working → input-required → completed agent.delegate → child run · max_depth · allowed_agents[] CHILD RUN · SPECIALIST Evidence reader retrieval over the bound knowledge bases run_steps(kind:'retrieval') CHILD RUN · SPECIALIST Policy checker granted tools only, through the gateway run_steps(kind:'tool') CHILD RUN · SPECIALIST Draft writer structured output, schema-validated run_steps(kind:'llm') the gateway's external path trust floor · egress DLP Shared blackboard — persisted on the crew run; each executor sees it, and the planner synthesises the final answer from it, not from the last reply. executors run in order, not in parallel 03 · EVERY STEP — PLANNER, SPECIALIST OR REMOTE — PASSES THE SAME FOUR GATEWAYS init → llm → gate → exec_tools → llm, ≤ max_steps ModelGateway picks the model for this step rules → complexity → availability route recorded on the llm step Knowledge service pgvector search over the bound KBs tenant + KB filter precedes the knn cited passages, as a retrieval step Durable state checkpointed to Postgres every step one checkpoint thread per tenant + run another worker resumes it after a restart ToolGateway resolve → validate → bind → inject → run credentials decrypted here, zeroed after ungranted ⇒ TOOL_NOT_ALLOWED 04 · HITL — THE GATE NODE CALLS interrupt() The graph checkpoints and parks at waiting_approval approve · edit · reject · respond — the decision API enqueues the resume job the worker reopens the graph by run id and resumes from the checkpoint 05 · WHAT COMES OUT runs · run_steps · usage_events · audit_log every model turn, retrieval, tool call, hand-off and decision, in order tokens_in · tokens_out · tool_call · external_agent_call — priced per call delegation — a child run, capped by max_depth and allowed_agents A2A hop — one tool step against a registered external agent a governed call — the gateway is the only path out
Where it lives
08 / 16

Our cloud. Yours. Or inside your network.

The same product in all three. Only the boundary moves.

Three ways to run it — our cloud, your cloud, inside your network — with the same platform and controls in all three. Our cloud run by us — the fastest start PLATFORM Runs in our cloud we operate, update, and watch it MODELS The provider you choose Azure OpenAI, Anthropic — your call DATA Sealed per customer isolation enforced in the database Your cloud your subscription, same containers PLATFORM Runs in your subscription the same containers, moved — not rewritten MODELS Your model endpoints the Azure OpenAI or Anthropic you already buy DATA Stays in your cloud your region, your boundary Inside your network your data centre · fully air-gapped PLATFORM Installed on your machines in your data centre, behind your firewall MODELS A model inside the network any OpenAI-compatible endpoint inside the network — or Azure OpenAI / Anthropic when reachable DATA Never leaves the building records, files, and keys stay inside available today — your machines, your model, no egress required CONSTANT IN ALL THREE Same platform. Same controls. people approve one door to systems a full trail sealed data
How anything connects
09 / 16

One seam. Everything crosses it the same way.

Connectors reach your systems. Channels are where people meet the agents. Knowledge sources are what agents read. Automation starts work and reports back.

Any external portal or system connects to the Agentic Workforce platform across one seam — connectors, channels, knowledge sources, automation, approvals and the remote-agent crossing. ANY EXTERNAL PORTAL OR SYSTEM It stays a standalone app — its own screens, its own database. A portal your people already open citizen, customer, staff or partner facing A back-office system you already run case management, ERP, ticketing, HR A system of record Postgres, SQL Server, Oracle — read-only by default A partner, mobile or third-party app anything that can hold an API key One SDK import. Nothing else. typed REST + server-sent events ALREADY RUNNING THIS WAY Every reference portal uses this same seam each its own app, its own data, the same integration Put your own system in its place and nothing in this picture changes. THE INTEGRATION SEAM 01 · CONNECTORS — WHAT AGENTS MAY DO IN YOUR SYSTEMS Agents operate your systems mid-run your system's own tools, discovered — then granted one by one 02 · CHANNELS — WHERE PEOPLE MEET THE AGENTS Your chat rides the SDK — live output back server-sent events, token by token Inbound webhooks turn a conversation into a run 03 · KNOWLEDGE SOURCES — WHAT AGENTS READ Your documents, indexed and searched answers cite the passage · source permissions preserved 04 · AUTOMATION — TRIGGERS IN / WEBHOOKS OUT Your events start runs and workflows HMAC-signed calls to /hooks/:trigger Signed, deduped results drive your state run.completed · run.failed · approval.requested · wait_event released ACROSS ALL FOUR · APPROVALS A privileged crossing waits for a person decided in our console — or on your own audited screen 05 · THE REMOTE-AGENT CONNECTOR Agents on other platforms — called, and calling in the open A2A protocol, or a native adapter who is on the other side, and both directions — next slide every call carries an API key scoped to one tenant THE PLATFORM SIDE One doorway. One set of rules. REST API + SDK your one doorway in signed, tenant-scoped Console & Workspace where your people watch, decide and inspect The same workforce an outside system is governed exactly like an inside one — same agents, same rules who does the work, and how, does not change with the caller
Co-existence — not replacement

Nothing outside has to move.

Your portal keeps its screens. Your system of record keeps its data. Your agents keep their platform. This seam is the only thing that is new — and it is the same seam for all of them.

Grants, the tool gateway and approvals govern every crossing, and each call is signed and scoped to one organization.

Agents on other platforms
10 / 16

Works with the agents you already have.

Register an agent once, then call it from a run, a workflow step or a hand-off — and let it call your workers back.

Azure AI Foundry Microsoft Copilot Studio Anthropic Claude IBM watsonx Orchestrate OpenAI Amazon Bedrock AgentCore LangSmith Google Agent Runtime Salesforce Agentforce ServiceNow any A2A server another deployment of this platform
Direction 1 · they call us

Our A2A agent card, or our MCP tool

Publish a worker and it is served as a signed A2A agent card (v1.0 and v0.3) and as an MCP tool, so anything on the list above can call it. Every inbound call is a real, metered, audited job; an approval pause shows on their side as input-required.

Direction 2 · we call them

A2A where they speak it, an adapter where they do not

Open A2A for Foundry, watsonx, LangSmith, Google, Salesforce, ServiceNow and any A2A server. A native adapter for Copilot Studio, Claude, OpenAI Responses and Bedrock AgentCore. Either way it is one governed step in a run, a workflow, or a hand-off.

Both directions · the same gate

A remote agent is governed like a local tool

Grants, approval policies, audit, data residency and a daily cost cap apply to a remote agent exactly as to any tool. Outbound text is screened for personal data and secrets; what comes back is data, never instructions.

Trust levels set floors, not ceilings. An untrusted agent needs a named person’s approval on its first call in a conversation, and a change to its published agent card disables it until an admin reviews it.

Where the limits sit today: Foundry is text only, without streaming · OpenAI means the Responses API · asynchronous callbacks are A2A only · agents are addressed directly, not through a marketplace.

Azure AI Foundry
11 / 16

Already on Azure AI Foundry? Keep it. Coexist across the boundary.

Foundry stays the Azure-native runtime plane — Entra, Purview, Defender, Monitor. This platform is the workforce control plane. Link to coexist; import to run here.

Two planes — the workforce control plane and the Foundry project inside the Azure boundary — joined by four crossings: understand, integrate, publish, import; with the honest status of each. TWO PLANES, ONE WORKFORCE Keep Foundry for Azure security, governance and traces. Use the platform as the control plane — and as a destination when an agent should leave Foundry. THIS PLATFORM — CONTROL PLANE Org tree · written manifests · versions Human approvals on every crossing Tenant audit trail · metered usage Project credential sealed — decrypted only at the call, never returned Drafts imported from Foundry review on by default · fidelity report one connection per project, per tenant YOUR AZURE BOUNDARY — FOUNDRY PROJECT The agents your team already built prompt · hosted · workflow agents Foundry Agent Service runtime Entra ID · Purview · Defender Traces in your Application Insights Vector stores · Toolboxes stay here — referenced, never copied model traffic never leaves Azure 1 · Understand inventory the project (both API generations) inspect definition, tools, knowledge, version 2 · Integrate invoke it where it runs — audited, metered — or link it as a peer under grants and approvals 3 · Publish a published worker becomes a Foundry prompt agent dry run first · drafts refused · omissions listed 4 · Import a Foundry agent becomes a draft here replaces “Foundry Local” · human review by default link = coexist on Azure · import = run here instead · only a published version may cross · everything that does not cross is listed The Entra app holds the Foundry User role on the project — Foundry Agent Consumer can invoke, but cannot list or create agents. Foundry Local is Microsoft's on-device model runtime, not an agent export: we replace the agent loop, not the local model host. WHAT IS TRUE TODAY Say it before they ask. Live-verified Understand inventory and inspect — passed live on 29 Sep 2026 Live-verified Integrate invoke and link — audited, metered; passed live on 29 Sep 2026 Live-verified Publish verified live once on 29 Sep 2026 · prompt agents only, no hosted agents Draft + report Import passed live 29 Sep 2026 · vector stores, Toolboxes, evals not copied API today; a console card is the next step. Verified live once against a Foundry project on 29 Sep 2026. a demo's Azure side costs cents — about $0.06 a month gpt-5-nano · basic setup · no metered tools · list prices 29 Sep 2026

Understand, integrate, publish, import. The agent never has to leave Azure; when it should, it arrives as a draft a person reviews.

Connecting a system
12 / 16

How a system is connected — five steps, safe by default

The same flow for every connector kind — an agent on another platform included. Default-deny from the first step; a person publishes the last.

Five steps to connect a system — choose, connect and verify, choose tools, grant and approve, done — with default-deny grants, pre-set approvals, and the health badges a connection shows. CONSOLE → INTEGRATIONS → CONNECT A SYSTEM Five steps. Nothing is callable until granted; nothing goes live until a person publishes. 1 Choose a connector kind — MCP, database, remote agent, HTTP API — or a catalog entry 2 Connect & verify credentials stored encrypted, the connection tested live — the badge tells the truth 3 Choose tools the system's tools, discovered; pick only what agents need — fewer tools, sharper agents 4 Grant & approve grant to an agent or org unit; write tools carry an approval by default 5 Done a person publishes — what ran is what was granted Default-deny nothing is callable until granted Approval pre-set for write tools nothing goes live until a person publishes THE SAME FIVE STEPS FOR EVERY CONNECTOR KIND MCP server Database — Postgres, SQL Server, Oracle Remote agent (A2A) HTTP API Default-deny. Grants inherit down the org tree; the most specific grant — agent, then unit, section, department, tenant — decides. Every call still passes the one door: schema check, grant check, approval check, audited execution. CONNECTION HEALTH One vocabulary for every integration type. Connected last check succeeded — handshake done, tools listed Credentials rejected the system refused the stored credential — rotate it, check again Awaiting first event channels and triggers: configured, the first callback not yet received Checked on a schedule and on demand; a stale check never shows plain green. Not checked yet · Needs credentials · Broken · Disabled complete the set. credentials unlocked only at the moment of use never in a prompt · never in a log · never returned by an API

Connect, verify, choose tools, grant, publish. Nothing is callable until granted; write tools wait for a person; what ran is what was granted.

One platform, many channels
13 / 16

One agentic platform. Every channel your people already use — and the ones coming.

A channel changes how a worker is reached. It never changes what the worker may do.

The agentic platform — one set of rules on every surface

Written roles, grants, approvals, audit and metering live here — once. Every channel below inherits them, and what ran is always what was approved.

Written rolespublished versions · what ran is what was approved
One tool doorgrants · schema · approval · audited execution
Human approvalsa named person decides the sensitive step — on any surface
Audit & meteringevery step, approval, token and cost on the job
Apps you build in the platformbrief › pages · sandboxed · checksummed · approved before publish
Channel · web

Workspace

The console's chat for members — agents, crews, approvals, the run inspector.

Chat, files, voiceattachments in · deliverables out · hands-free
Approvals inboxapprove · edit · reject · reply
Arabic and Englishthe layout flips for Arabic
Channel · your site

Web widget

One script tag puts a worker on your own portal or site, on your keys.

Origin-bound keysshort signed sessions · rate limits
Text first, voice per keypush-to-talk · hands-free, opt-in
Approvals stay insidea paused run is decided in the console
Channel · Android

Android app

The workspace on a phone — same workers, voice or typed, photos, approvals.

A device token, not a passwordminted by the member · scopes · worker pin · revocable
Voice and typed turnsthe orb · cards · phone camera · talk over it and it pauses
Also the glasses' companiontheir mic, speaker and camera when a pair is in range
Channel · Meta Ray-Ban glasses

Wearables

Hands-free through the Android app; what the wearer sees goes with the next turn.

Device toolsa photo · a location · a card — through the one door
Approvals by voiceread aloud · confirmed · transcript hash on the record
Off by defaultdeployment · tenant · written role · no identification of people
Direction
Not a product · below the line

Physical AI

The same pattern — device token, device tools, approvals by voice — is the path to physical agents.

Nothing is shippedno partner, hardware or certification named
Same rules would applya person decides the sensitive step · every action on the record

Where the limits sit today: the app is Android only, installed by hand — Meta's private tester channel for the glasses build · glasses features need the paired wearable and are opt-in per deployment, tenant and worker · voice needs a speech provider on the deployment.

The next conversation

See one journey. Then decide.

A real case. A person at the gate. The trail it leaves. If that is true, your teams can write the next workers on the same platform.

  • · see one journey — a real case, a human gate, the trail it leaves
  • · connect one of your systems in the room — read-only, approval-gated — or an agent you already run on another platform
console.agenticworkforce.me agenticworkforce.me

We do not hand over a black box. We hand over a workforce you can see.

14 / 16
© 2026 Agentic Workforce ME
Appendix
Capabilities
15 / 16

What is in the platform.

Available today, across orchestration, governance and knowledge.

Orchestration & agents
Versioned manifestspersona · skills · tools · guardrails
Org-tree inheritancedept › section › unit › agent
Durable runscheckpoint · resume · replay
Delegation & crewschild runs · shared blackboard
Workflowsagent · gate · branch · wait · external
Model routingrules · complexity · failover
Triggers & schedulessigned webhook in · cron
Immutable publisheswhat ran is what was approved
Governance & trust
Human in the loopapprove · edit · reject · reply
One tool gatewayschema · grant · approval · execute
Default-deny grantsthe most specific grant decides
Sealed credentialsdecrypted at call time, then zeroed
Tenant isolationrow-level security in the database
Append-only audithash chain · anchors · tamper alert
Guardrailsinjection · PII · egress · grounding, EN + AR
Budgets & meteringcaps checked before the call
Knowledge & memory
Knowledge basespgvector · cited passages
Knowledge sourcesindexed from a connected system
Long-term memoryagent · organization · per contact
Memory graphdated facts · supersede, never delete
Evidence modenothing retrieved ⇒ no answer
File deliverablesxlsx · pptx · static HTML
Run inspectorreplay every step of any job
No training on your datano fine-tuning, no in-house model

●  Available today

○  Planned — listed on the next slide

Appendix
Capabilities
16 / 16

How it connects, where it runs, what people touch.

Available today. Planned items are marked below.

Integration & channels
ConnectorsMCP · database · HTTP API · remote agent
Channelsweb · WhatsApp · Telegram · email · Workspace
Teams · Slack · SMS · voicewith your provider credentials
Automationsigned triggers in · signed webhooks out
External agentsFoundry · Copilot Studio · watsonx · OpenAI · …
A2A both wayssigned agent cards · MCP tools
Your own appstyped REST + SSE SDK · embed widget
Connection healthone vocabulary for every integration
Deployment & scale
Our cloudwe run, update and watch it
Your cloudsame containers, your subscription
Inside your networkyour machines · fully air-gapped
Your modelsAnthropic · Azure OpenAI · OpenAI-compatible
The stackPostgres + pgvector · Redis · queue workers
Arabic and EnglishArabic guardrails, not translated labels
Enterprise controlsSSO · SCIM · residency · isolation tier
Compliance operationsexport · erase · retention purge
Experience & delivery
Consoleorg chart · builder · versions · publish
Workspacechat · approvals · run inspector
Two console skinsstandard and glass, one codebase
Console copilotanswers, and drafts you confirm
Mind-map buildersketch, then publish the recorded drafts
In-app voicepush-to-talk · Talk session · browser hands-free · Meta Ray-Ban glasses · pauses when you talk over it
Evaluation & replaygolden tasks · scoring · usage
Build apps in the platformbrief › pages · sandboxed · checksummed · approved
Planned
Integrations hub in the console — next release Teams / Slack / SMS / voice without your own provider credentials Per-user OAuth connections OpenAPI / REST import MySQL System-event triggers A cross-cloud marketplace of other people's agents Physical agents and robots — a direction, not a product

Agents on other platforms are addressed directly, over A2A or a native adapter. Physical agents: the glasses' device-token, device-tool and voice-approval pattern is the path — nothing is shipped, no partner or certification is named.

← → · Space · F fullscreen · N notes