FinAIOSby FinoGeeks

Platform

Give agents real permissions, on infrastructure you trust

FinAI OS is the managed agent platform for regulated enterprises. It runs agents on the server and on the desktop, contains each one in a sandbox, checks every skill before it's installed, and routes every action on your enterprise systems through an action gateway. All of it runs on-prem or in your private cloud.

The governed path, from install to actionIllustrative
One governed path A path from a new skill or agent to your enterprise systems passes three checks: FinSkills Hub checks a skill at install, FinSAFE confines the agent while it runs, and FinGuard gates each action on an enterprise system. All links ship today. FinHub spans the whole path as the governance plane that sees and audits server agent runs; FinDesk logs network connections in its on-device Audit center. One governed path Each step checks something different, at a different moment. VISIBILITY ACROSS THE WHOLE FLOW FinHub Governance plane: sees and audits server agent runs, from skill install onwards. Can we see it? A skill or agent New skill or task INSTALL Can it get in? FinSkills Hub Checks a skill before anyone can install it. Part of FinHub. RUN Can it run contained? FinSAFE Confines the agent while it runs, on servers or inside FinDesk. ACT Can it break things? FinGuard Gates each action on an enterprise system. An agent can't approve its own request. Your systems Enterprise and legacy systems Each check happens at its own moment. Source: FinAI OS architecture spec, October 2026. Draft figure. ships today

FinHub checks every skill before it's installed and keeps the record; FinSAFE contains how every agent runs; FinGuard decides whether each action on your systems should happen.

FinGuard becomes the route to your systems by holding their credentials, and FinSAFE's network allowlist can make it the only system an agent can reach. The platform connects to FinGuard directly.

Source: FinAI OS reference architecture. Schematic, not to scale.

Platform

One platform, server and desktop

FinHub is the managed agent platform. It runs FinClaw, supports Hermes through an adapter, and is designed to take other runtimes through one runtime contract. Server runtimes run inside FinSAFE's sandbox service by default. Skills are checked in FinHub before anyone can install them. FinDesk, the white-label AI desktop, connects to the platform's AG-UI gateway and uses the models it manages; on the desktop, FinClaw, Hermes, Codex, dsh, pi-agent and others run locally, each inside FinSAFE by default. Agents can connect to FinLore over MCP for cited enterprise knowledge. FinGuard sits in front of your enterprise systems and decides whether each action should happen; FinAI OS routes every server agent, desktop agent and skill action through it, and Fintology, in design, will define the rules, schema and ontology FinLore's knowledge follows.

FinAI OS stack Five layers, top to bottom. Experience: FinDesk, FinClip, Web chat, AG-UI clients and IM channels. Touchpoints connect through the AG-UI gateway of FinHub; FinClip is a separate mobile-app surface with no connection to FinHub or AG-UI. Agent runtime: FinClaw runs on the platform (server) and locally inside FinDesk. Third-party runtimes, run through FinHub or FinDesk: Hermes, Codex, dsh, pi-agent and more. Governance & resources: FinHub, the managed agent platform, with the AG-UI gateway, managed models, agent fleet manager, FinSkills Hub (FinHub's skill catalog) and audit of server runs. FinHub manages the server runtimes and supplies reviewed skills. Knowledge & business rules: agents connect to FinLore as an MCP tool (thin line); Fintology is designed to govern FinLore (dashed); FDE engineers build the ontology and knowledge graph. Control & safety: FinSAFE confines every runtime, as sandbox-as-a-service or as its desktop build. The platform routes every enterprise action, from server and local agents, through FinGuard. Solid lines ship today. FinAI OS One managed agent platform for server and desktop agents that gates every enterprise action. Layer 5 EXPERIENCE Where clients, advisors and staff meet the agents. FinDesk Desktop client. Runs local runtimes, each inside the desktop build of FinSAFE (layers 4 and 1). Network connections are logged in its on-device Audit center. Web chat AG-UI clients Your own apps IM channels Team messaging FinClip Mini-program runtime in your mobile apps AG-UI and managed models Layer 4 AGENT RUNTIME Run agents with FinClaw and supported third-party runtimes. ON THE PLATFORM (SERVER) FinClaw Multi-tenant agent runtime INSIDE FINDESK (LOCAL) FinClaw Multi-tenant agent runtime Third-party runtimes, run through FinHub or FinDesk Hermes Codex dsh pi-agent and more manages reviewed skills Layer 3 GOVERNANCE & RESOURCES The kernel: orchestrate agents per tenant and govern the resources they use. FinHub Managed agent platform AG-UI gateway One entry point for FinDesk and every other touchpoint Managed models Models for server and desktop agents Agent fleet manager Runs each runtime in FinSAFE FinSkills Hub FinHub's skill catalog checks before install Audit and governance Sees and records every server run Layer 2 KNOWLEDGE & BUSINESS RULES What agents know, and how it is structured. FinLore Privately hosted knowledge base. Agents connect to it as an MCP tool to retrieve and cite enterprise documents. designed to govern Fintology Designed to define the rules, schema and ontology that FinLore's knowledge follows. builds SERVICES · FDE Our forward deployed engineers use agents to connect your data sources, clean and resolve the data, and build your ontology and knowledge graph. connects to (MCP) every enterprise action, from server and local agents and their skills Layer 1 CONTROL & SAFETY Every agent runs contained; FinGuard decides each write that goes through it. FinSAFE One sandbox, two forms Sandbox-as-a-service for server runtimes Desktop build for each local runtime, inside FinDesk FinGuard Action gateway Checks every write against policy · an agent can't approve its own request · hash-chained audit trail YOUR EXISTING SYSTEMS Enterprise and legacy systems: ERP · CRM · email and tickets · internal APIs The stack Server and desktop agents, one platform Source: FinAI OS architecture spec, October 2026. Draft figure. designed path connects to ships today

Each shipping product is sold on its own. Together they make one platform: one governed path from install to action.

Server agents, as an enterprise resource

On the platform, agents become something your teams assign, constrain, audit and replace. Each runs in its own FinSAFE sandbox, uses models from a catalogue you control, and every conversation lands on one append-only record. Hermes is supported through an adapter, and the platform is designed to take other runtimes through the same contract.

Desktop agents, sandboxed on the device

FinDesk can get its models and reviewed skills from the platform. Its local agents run inside FinSAFE by default, and their network connections are logged in FinDesk's on-device Audit center.

Knowledge

What agents know, with sources

FinLore turns your documents into a private, citable knowledge base, and agents can connect to it over MCP. Fintology, in design, is the ontology of your enterprise knowledge: the rules, schema and relationships FinLore is designed to follow. Our Forward Deployed Engineers already build ontologies and knowledge graphs with customers, in the customer's own environment, by design, connecting their data sources and using agents to help clean and resolve the data.

Services

Deployed with Forward Deployed Engineers

Our engineers connect FinAI OS to your identity, data, models and controls, build your ontology and knowledge graph, and stay until your team runs it.

How an FDE engagement runsTypical sequence · scope varies by institution
  1. Phase 1

    Assess

    Map use cases, data sources, controls and the regulatory perimeter.

    Output: deployment blueprint
  2. Phase 2

    Ground

    Connect identity, data sources and policies; build your ontology and knowledge graph.

    Output: governed staging environment
  3. Phase 3

    Deploy

    Ship the first agents to production, sandboxed, with FinGuard in front of your systems and audit on.

    Output: production workload
  4. Phase 4

    Hand over

    Runbooks, training and ownership transfer to your platform team.

    Output: self-operated platform

The 8-week visibility pilot

Start by seeing what your agents already do

The 8-week visibility pilot runs FinSAFE's desktop build in audit mode on one department's desktops, recording what agents do before any policy is tightened. You get an agent activity baseline, a list of high-risk activity and a draft policy.

Next step

Ready to give agents real work, on your terms?

Talk with a Forward Deployed Engineer about FinAI OS, a single product or the wealth solution. Or start by seeing what your agents already do, with the 8-week visibility pilot.