The system that creates and operates systems.
AISAC turns intent into governed, versioned and continuously operable AI systems — specified, generated, verified, deployed, operated and evolved through Governed Agentic Workloops.
Probabilistic autonomy for thinking.
Deterministic governance for acting.
AI stopped merely answering. Now it has to operate.
Agents already use tools, write into systems, publish content, trigger other agents and keep working on events and schedules. Once intelligence produces real effects, prompts stop being a sufficient layer of governance.
Prompt→Model→Response
A person in command of every step. The effect ends at the text.
Intent→System Forge→Governed Workloops→External effects
Autonomous loops with their own triggers, crossing gates, authority and traces before anything reaches the world.
The challenge is not only to give AI more autonomy. It is to build the infrastructure that defines how far that autonomy can reach.
An agent is not an organisation
An agent has a model, a prompt, tools and a task. A real operation demands multiple responsibilities, independent triggers, cost control, authority limits, traceability, concurrency and change governance.
Policy in a prompt is probabilistic policy
“Never offer more than a 10% discount” inside a loop can be obeyed, misread, injected or forgotten. The prompt guides intent; only code executed outside the model enforces the rule.
The risk lives between loops
Support writes to the CRM that sales reads. Marketing publishes something that returns as a comment. One loop asks another for an action it could not perform itself. These are governed interfaces — not informal conversations between agents.
AISAC turns intent into a governed operational unit.
AISAC is a meta-system for engineering and operation. It defines objectives, authority, contracts, loops, channels, tools, memory, gates, infrastructure and evidence; it deploys the resulting system; and it keeps operating and evolving its workloops over time.
Specify
Objectives, contracts, authority, schemas and limits become versioned artefacts.
Create
The System Forge generates loops, services, integrations, gates, tests and infrastructure.
Operate
Autonomous workloops run continuously on events, messages and schedules.
Govern
No relevant interaction or external effect crosses an interface without a deterministic gate.
Observe
Traces, outcomes, costs and policy decisions make the operation auditable.
Evolve
Meta-loops improve the system inside the envelope. Authority changes stay human.
Not just infrastructure as code. The entire system as code.
Objectives, contracts, triggers, channels, permissions, gates, budgets, tools, memory, deployment, traces, tests and runbooks can all be versioned as parts of one operational definition.
“System As Code” does not mean source code alone. It means the system's operational structure can be expressed as artefacts that are versioned, verifiable, auditable, reproducible, comparable, testable, deployable and reversible.
Once the system has a verifiable definition, it becomes possible to:
- generate new instances and replicate child systems
- compare intent, specification and runtime — and detect drift
- test before any real effect is released
- promote an operation from
drytolive - reproduce decisions and audit which policy was active
- limit the blast radius and roll a version back
Reasoning stays probabilistic. The structure and the limits become reproducible, verifiable and deployable.
Creating is only half the system. Operating is the other half.
Generating code does not produce an operationally complete system. The AISAC cycle runs from human intent to governed evolution — and it does not end at the commit or the deploy.
Intent
Objectives, constraints, budget and human authority. At this point there is an intent; there is not yet a system.
Specify
Workloops, contracts, channels, decidable rules, policies and the maximum impact envelope.
Generate
Agents, services, loops, gates, schemas, migrations, tests, environments and runbooks.
Verify
Gates produce deterministic decisions, cannot be disabled by the model, and have no alternative path around them.
Instantiate
Identity, environment, database, queues, credentials, schedules, domains and observability.
Deploy
Progressive promotion: draft → dry → shadow → limited → live, with explicit conditions.
Operate
Triggers, routing, mediated state, tool execution, budgets and enforcement.
Observe
Traces, gate decisions, blocks, escalations, costs, failures and the impact produced.
Evolve
Meta-loops optimise inside versioned limits. The envelope does not modify itself.
Not a workflow. A system of autonomous loops under an authority.
A Governed Agentic Workloop brings together two or more agentic loops with their own triggers and lifecycles. They interact through explicit channels — message, event or mediated shared state — and no interaction between loops and no externally effecting action occurs without crossing a deterministic gate that enforces the authority's policies.
Freedom inside the loop
Inside the loop the model explores, plans, picks strategies and decides the next step. Freedom of reasoning is preserved — that is where the capability comes from.
A gate at every interface
Messages, events, shared state and external actions cross computable rules. Interface here is neither a screen nor necessarily an API: it is every point where something crosses a loop's boundary.
Human authority above the loop
Humans define policies, budgets, limits and escalation. The model does not redefine its own envelope — the set of limits that determines the maximum effect the system is allowed to have.
Workflows organise steps. Workloops govern systems of loops.
A workflow belongs to a runtime, usually has a predefined flow, and its nodes need no independent triggers. A workloop is a system of autonomous loops, each with its own trigger and lifecycle, under a common authority, with a gate at every relevant interface. Deterministic workflows can live inside a workloop — but a workloop does not reduce to them.
When the graph crosses the boundary of the authority — an email sent, a comment on a social network, a third-party webhook — the workloop is open, and demands additional defensive rules: a gate on every outbound action under your control, self-origin marking, hop budgets, cooldowns, and no trust in anyone else's gates.
Decidable rules become gates. The rest becomes structure.
A 10% discount ceiling, a daily budget, a recipient on an allow-list, an action permitted for that role, a hop limit, a payload matching a schema: all of this is verifiable by code and belongs in a gate.
“Is this text appropriate?”, “is the tone right?” require semantic interpretation. Whenever possible they become structure — approved templates, enumerated actions, typed variables, permitted ranges. What stays semantic can use probabilistic review and, above an impact threshold, human review.
A second AI can review quality, tone or fit — but that review is probabilistic and does not replace the gate.
The model decides what it wants to do. The gate decides what happens.
A gate is a computable predicate returning ALLOW, BLOCK or
ESCALATE from deterministic state alone — identity, schema, allow-list,
effective chain authority, budget, rate limit, hop count, time window, provenance, policy
version, idempotency key. It does not depend on a model's judgement.
10%DISCOUNT_LIMIT_EXCEEDED — effective chain authority exceededA model may conclude it should spend $100,000 on ads. If the gate enforces a $500 daily cap, the model's conclusion is not enough to produce the effect.
Maximum impact envelope
Even if every probabilistic layer fails, the deterministic layer prevents any action outside the permitted envelope. The goal is not to guarantee the model never errs — it is to guarantee the error cannot exceed the limits the authority defined.
Effective chain authority
When an action crosses Loop A → Loop B → Service C, the effective permission is the intersection of the whole chain. A loop gains no power by delegating to another. A child system never obtains more authority than the system containing it.
Model-independent interruption
The authority must be able to stop any loop, channel, integration or the entire system — by kill switch, token revocation, schedule deactivation, queue suspension or a global deny policy. Outside the model's control, and tested regularly.
An architecture to create, connect, govern and evolve systems.
Every layer exists to allow more autonomy without giving up authority, evidence or the ability to interrupt.
Don't just build agents. Build systems.
| Isolated agent | AISAC system |
|---|---|
| Prompt | Mission and contracts |
| Tool call | Governed capability plane |
| Chat memory | Persistent institutional memory |
| Safety instruction | Deterministic gate |
| Local log | End-to-end trace |
| One process | Composite workloops |
| Informal autonomy | Explicit authority and envelope |
| Code delivery | Continuous operation |
One architecture, one specification, real products and a community of builders.
Workloop Spec
The public specification that formalises the operational model: loops, channels, interfaces, deterministic gates, effective chain authority, open and composite workloops, meta-loops, invariants and conformance criteria.
Text under CC BY 4.0, with an open repository for comments.
AI Brain
Persistent memory shared across ChatGPT, Claude, Codex, agents and other MCP-compatible clients. Knowledge in Markdown, connected by wiki-links, backlinks and search — available beyond a single conversation or platform.
It is the ecosystem's knowledge plane, not AISAC itself.
AISAC Community
The network of builders and architects building the infrastructure for AI-operated companies — with community, education and verifiable credentials.
Community · Academy · Credentials.
MCPs are capability interfaces. AI Brain is the memory layer. Workloop is the operational model, formalised by the Workloop Spec. AISAC is the higher-order meta-system that integrates and governs the set — none of the three, on its own, is AISAC.
The infrastructure needs architects.
The AISAC Ecosystem trains and connects the generation of builders and architects turning isolated agents into governed operations — consolidating a discipline, Agentic Infrastructure Architecture, and a professional role: the Agentic Infrastructure Architect.
Understands the movement, takes part in the network and builds repertoire.
Builds agents, MCPs, integrations, loops, gates and systems.
Designs authority, contracts, boundaries, composite workloops, memory, governance, observability, infrastructure and evolution.
The thesis has started to become real infrastructure.
What follows already exists or has already been demonstrated. What belongs to the long-term vision is in the next section, and is labelled as vision.
A public specification
The Workloop Spec formalises the operational model, its invariants and its conformance criteria, with an English normative source, a Portuguese translation and an open repository.
Persistent memory in production
AI Brain is a hosted MCP server with authentication, per-user data isolation and memory shared across different AI clients and sessions.
From intent to an operating loop-company
A company-forge experiment took a product intention to a governed content
operation: it generated its loops, its toolchain and its dry-run lifecycle before any
external effect was enabled. Governance did its job during the early failures — a bad
render was rejected and an upload bug was caught, with no blast radius, because the system
was still in dry mode.
Limit of the claim: at that milestone there was no complete headless orchestrator, no factory-held credentials across the whole chain, no global cost enforcement and no fleet operations.
Specialised systems, composed through contracts
The ecosystem connects an AI-operated interface to specialised systems — such as a 3D renovation environment — preserving ownership boundaries, authentication, versioned contracts between systems and validation on both sides.
Limit of the claim: composition between systems with separate responsibilities, not one system operating the other's domain.
Systems able to create systems — without creating their own sovereignty.
The AISAC vision is a mother-system able to specify, generate, deploy, operate, observe and evolve a fleet of child systems. Recursion increases capability; authority attenuation preserves human control.
Operated by AIs. Governed by humans.
This does not mean a person approves every action by hand. It means the human defines the mission, the policies, the envelope, the authority, the budgets, the escalation conditions and the mechanism for changing policy. The AIs then operate autonomously inside that structure.
No human inside the normal operational loop.
Human authority above the loop.
Self-improvement inside the envelope
Meta-loops can adjust prompts, parameters, models, templates, schedules and budget allocation within caps. They cannot change the gate governing them, raise their own limit, remove traceability, alter the normative contract or replace human authority.
Changes of that kind cross a policy-change interface, with human authority, a version, a record, a justification, evidence and a way to roll back.
Components of this vision — a complete headless orchestrator, fleet-wide cost enforcement, fleet operations and automated conformance — are still being built.
Systems can create systems. The envelope does not modify itself.
An architecture for the era of AI-operated companies.
Bruno Bracaioli is the creator of AISAC and of the Governed Agentic Workloop concept, and the author of the Workloop Spec. His work focuses on Agentic Infrastructure Architecture: the discipline of designing systems where AIs can operate with autonomy without taking authority over their own limits.
Bruno Bracaioli Agentic Infrastructure Architect Creator of AISAC and Governed Agentic Workloop Author of the Workloop Spec
Frequently asked questions
What is AISAC?
AISAC stands for Artificial Intelligence System As Code. It is a meta-system that turns human intent and authority into governed, versioned, deployable and continuously operable AI systems.
Is AISAC an AI agent?
No. Agents can exist inside an AISAC system. AISAC is the higher-order architecture that creates, connects, governs, operates and evolves the whole system.
What is a Governed Agentic Workloop?
A system of two or more autonomous agentic loops interacting through explicit channels under a common authority, with deterministic gates on every interaction and externally effecting action.
What is the difference between a workflow and a workloop?
A workflow is an orchestrated flow belonging to a runtime. A workloop is a system of loops with their own triggers and lifecycles, interacting under an authority.
What is a deterministic gate?
A computable rule enforced outside the model's control that allows, blocks or escalates an action. The same input and the same state must produce the same decision.
Can the AIs improve the system themselves?
They can optimise components within defined limits. They cannot autonomously change the gates, policies, normative contracts or the envelope that governs them.
Who governs AISAC?
Authority is human or organisational. Humans define policies, permissions, budgets, limits and escalation mechanisms. The AIs operate inside that envelope.
What is the Workloop Spec?
The public specification that formalises the concepts, invariants, requirements and conformance criteria of Governed Agentic Workloops. Available at workloop.b2tech.io.
What is AI Brain?
A persistent memory layer shared across AIs through MCP, keeping knowledge and context available across sessions, agents and compatible clients. Available at ai-brain.aisac.cloud.
What is the AISAC Community?
The network of professionals building the infrastructure for AI-operated companies, with community, education and credentials. Available at aisac.community.
Is AISAC finished?
The ecosystem already has a public specification, products, integrations and real operational experiments. The full vision of a headless mother-system and fleet operations is still evolving.
The next generation of companies will not be operated by a single agent.
It will be composed of systems of loops, memory, tools, contracts and policies — with probabilistic intelligence to operate and deterministic governance to act.