Forge Agents · Flagship agent
Talos
The operations agent, introduced like a model.
Talos is Aerandil's flagship operations agent — a versioned definition, published behaviour, evals that gate release, and trust you can read as a number. Its value is action through the ontology, not chat: it resolves the guest's situation by finding the objects and driving the governed actions.
In the myth, Talos was the bronze automaton built to guard Crete — three circuits of the island's shore a day, on set rounds, within hard limits. Mythology's first autonomous machine was a guardian with a boundary: autonomy inside a perimeter, in service of the people within it. That is the design brief, four thousand years early. The name is a promise about restraint as much as capability — a machine trusted with the watch precisely because everyone could see the rounds it kept.
0.1.0Version
120kTokens / run
30Tool calls / run
4Trust metrics
3Enforcement layers
Read straight from the definition — and enforced by the runtime and the kernel, not the honour system.
The workVersion 0.1.0 · two flows live
Built for the property's worst hour.
A flight cancels at midnight and the guest is standing at the desk. A complaint lands mid-service. Talos's launch flows are the moments that decide a stay — worked through the system of record, in front of the operator.
01TriageEvery inbound guest message classified and routed — intent, urgency, and the objects it concerns. Low stakes, so it applies directly.
02Rebook on disruptionFinds the reservation, reads live availability, proposes the move with its reasoning attached. The desk confirms; the kernel executes.
03Service recoveryDrafts the recovery gesture with the evidence in hand — reservation, folio, history — and waits for a human before anything posts.
The fleet arrives as definitions, not new runtimes — front-office and F&B agents are further documents on the same loop.
The definitiontalos.yaml
Talos is a document, not a deployment.
The whole agent is declarative: a definition the runtime interprets, stored where Aerandil stores every contract — the ontology, versioned and audited. Published versions are immutable; installations pin one. What Talos may do is written down, and the runtime enforces it.
# talos.yaml — the definition the runtime interprets (abridged) name: talos published_version: "0.1.0" model: claude-opus-4-8 model_allowlist: - claude-opus-4-8 budget: tokens: 120000 tool_calls: 30 obo_scopes: - actions:hospitality.action.triage_guest_message:apply grounding_scope_ref: front-desk tools: - name: search_ontology - name: query_analytics - name: hospitality.action.propose_action - name: hospitality.action.triage_guest_message - name: hospitality.action.record_service_recovery confirmation: confirm - name: hospitality.action.cancel_reservation confirmation: confirm eval_suite_ref: talos-evals.json
model_allowlist
The model is pinned, and any swap is bounded by an allowlist. No silent upgrades.
budget
Per-run ceilings on tokens and tool calls, enforced by the runtime. A run that exceeds them ends.
confirmation: confirm
Gated tools are withheld from direct execution. The only path to them is a proposal a human confirms.
obo_scopes
The scopes Talos may exercise on behalf of an operator — intersected with that person's own clearance when the token is issued.
Groundinggrounding_scope: front-desk
It cites its sources, or it doesn't act.
Before Talos acts, it retrieves: semantic search over the live graph, numbers from the same conformed catalogue as occupancy and ADR. Every decision cites the objects — type and id — it rests on. A curated grounding scope bounds what it reads: the front-desk bundle of object types, metrics, and human-verified examples.
# from the published system prompt — versioned with the definition Ground every decision in data you retrieved this session — use semantic search and the query tools before acting, and cite the objects (type + id) your decision rests on. Never invent reservations, folios, or guests.
The system prompt is part of the definition — shipped in the open, versioned like everything else.
AuthorityDefence in depth
The credential bounds it, not the prompt.
Prompts are advice. Talos's authority is enforced three times, independently — and no layer trusts the other two.
01Runtime policyEvery tool call is decided before it runs: allow, propose, or deny. Confirmation-gated tools are structurally withheld from the loop — Talos cannot call them directly at all.
02The credentialTalos runs on an installation-bound token. Scopes are intersected with the installation's grants at issue time; expiry is capped by the installation. Suspend the installation and minting stops.
03The kernelTyped validators, information markings, and tenant isolation judge every action last — exactly as they would for any other caller.
When an operator invokes Talos, it acts on their behalf: effective authority is the installation ceiling intersected with that person's clearance, and the event record carries both identities.
Human confirmation
Talos cannot confirm its own proposals.
Risky actions degrade into proposals: parameters snapshotted, rationale attached, waiting in Explorer's approvals inbox. A human confirms; the kernel fires the typed action. Agents are structurally barred from the confirm surface — that is architecture, not policy.
EvalsThe flywheel
Talos ships through its evals.
A definition that doesn't clear its suite doesn't publish. The suite itself is minted from production: real runs become traces, strong traces become cases, and the cases gate the next version.
- 01 · Trace
Every session persists a replayable record of what Talos saw, retrieved, and did — typed spans in the durable store.
- 02 · Assess
Humans and graders attach assessments to real traces — one quality vocabulary, offline and online.
- 03 · Promote
Strong traces are promoted into eval cases. Ephemeral fixtures rebuild each case's world on demand, so cases never go stale by accident.
- 04 · Grade
Suites run in two lanes: deterministic checks in the kernel's harness, LLM-as-judge verdicts for the rest.
- 05 · Experiment
Candidate definitions compete over one shared suite before any change ships.
- 06 · Retire
Cases that no longer earn their place are retired through a governed action. The suite stays honest.
TrustConformed MetricDefs · live
Trust is measured, then widened.
Every propose-and-confirm decision lands in a decision cohort, and four metrics are computed over it — governed definitions in the same catalogue as ADR, not a dashboard someone maintains by hand. Autonomy widens when the numbers earn it.
agent_containmentThe share of proposals a human confirmed with the parameters unchanged — Talos's judgement accepted as-is.
agent_override_rateThe share of proposals a human declined. The headline distrust signal.
agent_edit_rateAmong confirmed proposals, the share the human corrected before applying — intent accepted, details fixed.
agent_weighted_acceptanceThe composite score: full credit for accepted-as-is, half for accepted-with-edits, none for rejected or expired.
The boundary
No private door.
Talos reaches the platform only through the surfaces a partner gets — MCP and the generated SDKs, under OAuth like everyone else. That is deliberate: if the public contract isn't good enough for our flagship agent, it isn't good enough. The ergonomics we sell are the ergonomics we live with.
Forge Agents
See Talos work
your operation.
Aerandil is in private development. The next milestone is working with design partners who operate complex, multi-system hospitality businesses.
Design partner channel coming soon.