Skip to main content

Concepts

The core building blocks you'll work with in O2AGENT.

Agents​

An Agent is a registered, named unit of agent logic. Creating an agent mints it a first-class identity, so every invocation — human-initiated or autonomous — is properly authenticated and scoped, never a bag of unaccountable API keys.

Versions​

An Agent Version is an immutable snapshot of an agent's configuration: its system prompt, the tools it can call, and which model it runs on. Versioning means you can iterate on an agent's behavior without disturbing what's currently live.

Deployments​

A Deployment marks a specific version as the one currently serving invocations. Promoting a new version to active is a single, auditable action — and rolling back is just as simple.

Tools​

Agents act in the world through Tools — callable capabilities described to the model in a provider-agnostic shape. This includes built-in capabilities like sandboxed code execution (so an agent can write and run a script as part of completing a task) as well as external tool servers over protocols like MCP.

Model Providers​

O2AGENT talks to language models through a pluggable Model Provider interface, so an agent's version declares which provider and model it uses without the platform — or your application code — being locked into a single vendor's API.

Tenants​

A Tenant is an isolated organization within O2AGENT. Every resource — agents, versions, deployments — belongs to a tenant, so you can run O2AGENT for a single team or host many organizations on one deployment.

Identity & Access​

O2AGENT doesn't build its own user store or authentication system — it delegates identity entirely to O2ID, a purpose-built identity provider for platforms like this one. That gets you, out of the box:

  • Human accounts and role-based access control for your team
  • First-class agent identities, each with its own credential and a ceiling on what scopes it can ever be granted
  • Human-to-agent delegation ("let this agent act on my behalf, for this scope, until this time"), so autonomous actions stay traceable to a real person's authorization when that matters
  • Standard OAuth2/OIDC throughout, so integrating O2AGENT into an existing identity landscape is straightforward

The Gateway​

Every invocation passes through the Gateway, which verifies the caller's token, enforces rate limits, and routes the request to the Runtime — the same single entry point whether the caller is a human via the CLI/TUI, a script, or another agent.

Traces​

Every invocation is traced end to end — the model calls, any tool executions, and how long each step took — so you can see exactly what an agent did and debug it when it doesn't behave the way you expect.