A product that offers agents, plural — a researcher, a drafter, a coach, whatever a user decides they need — has to answer a question that stays comfortably unasked while there is only one assistant: what, exactly, is an agent? The answer determines everything about how fast the platform can grow. If each specialist is code, then every new agent is a software release: written by us, reviewed by us, shipped on our cadence, and the "create an agent" button is a feature request form. If an agent is data, a new specialist is a record — created at conversation speed, by the user, on a Tuesday.
But "make it all data" is not an answer either, and the reason it isn't is the interesting part. An agent in this system holds real capability — tools that read mail, write files, remember things — behind real guardrails: security boundaries, disclosure rules, confirmation gates. Make everything configurable and those guardrails become suggestions, editable by whoever writes the most persuasive identity file. Make nothing configurable and there is one assistant forever. So the whole design problem compresses into one line-drawing exercise, mechanism against policy: what varies between two agents, and what must not?
This week we drew the line, and the criterion that survived contact with every block of the existing prompt is: mechanics are platform; opinion is identity.
The conflation, named
Until now the assistant was a single role hard-coded into one large system prompt — a chief of staff: conversation-first, files everything, captures personal facts exhaustively, owns the relationship. Reading that prompt with the line-drawing question in hand, it fell apart into two kinds of content that had never been distinguished:
Platform — how tools are called correctly, what the vault's write rules are, how memory operations work, what may never be disclosed, which actions need confirmation. None of this is personality. Every agent needs all of it, verbatim, because it describes how the world works here, and two agents with different beliefs about how the world works is not diversity, it is a bug.
Identity — everything with a point of view. That the assistant is personal rather than public. That it files email into these folders under this taxonomy. That it proactively captures every personal fact a message contains. Each of those had looked like a product rule; each is actually one character's worldview. A researcher agent should not assert "I am your personal agent". A drafting agent has no business filing your email. And — the subtlest one — what an agent chooses to remember is part of its character: the chief of staff's capture-everything reflex, applied by a researcher, would flood the user's shared knowledge graph with research trivia. Memory posture turned out to be opinion, not mechanics, and it took reading every block through the question to see it.
The split shipped as structure: a platform block, built once and identical for every agent, and a per-agent block assembled from data. The default assistant is no longer special-cased anywhere in code — it is special because of what its identity says, which is the test the whole design has to pass: if the flagship agent needs a code branch, the abstraction has failed.
Three files, not one — and one of them is not a file
The identity half follows a three-part model, borrowed with credit from soul.md, an open-source three-file agent-identity pattern whose insight we think is exactly right: who an agent is and how it sounds are different assets.
Identity is the role — what this agent believes, cares about, is for, plus its house rules. Style is the linguistic surface: cadence, vocabulary, register, tics. Keeping them separate is not tidiness; it is because style is the most cloned part. A user who loves their drafter's voice but wants a coach copies the style and writes a fresh identity. Someone sharing a researcher agent publishes the identity and lets the importer keep their own voice. Voice transplants are a real operation, and the storage model should make the operation a copy, not a surgery.
The third part, the skills index, is the odd one out: nobody writes it. Which capabilities an agent holds is controlled by explicit grants, toggled per agent — and the prompt's "what you can do" section is generated from those grants at build time, every time. The alternative — capability lists hand-written into identity files — fails the way every hand-maintained mirror of real state fails: it drifts, and then an agent confidently describes powers it no longer has. What the agent is belongs to its author; what the agent can currently do belongs to the system that actually knows.
The storage decision, made the same day
The first draft of this design stored agent definitions as files in the user's vault — natural, human-editable, already synced. It was superseded within the day, before anything shipped on top of it, and the reason is worth recording because it is about what an agent is for, not where bytes live.
An agent definition has a lifecycle a personal file does not. It is owned, but wants to be shared — with another user, with a team, eventually with a marketplace. It is edited from multiple surfaces, concurrently, and a lost update to an identity is character damage. It carries authorization-relevant facts — whose it is, who may run it, what they have granted it — which must be readable by the server making access decisions and writable by nobody else. Every one of those is a database property. So agents and skills became top-level Firestore documents: an owner reference, sharing fields, visibility; the prose bodies — identity, style — as subdocuments; and per-user installation records binding a shared agent to what this user has actually granted it. Files would have made the single-user case pleasant and every case after it a migration. The record makes sharing a field update — which is what "a new specialist is a record, not a deploy" buys at the platform level, not just the user level: the marketplace is not a future subsystem, it is a visibility value.
What this makes possible, and what it refuses
By the end of the week the platform hosts the default assistant, and any specialist a user creates beside it — a researcher who cites and refuses to write final copy, a drafter who writes in the user's own voice and touches nothing but drafts — is nothing but records: an identity, a style, a set of grants. Creating another is an insert. Sharing one is a field. Renaming one cannot orphan anything, because display names and stable slugs were deliberately un-conflated in the same change — the human-facing name is decoration over an identifier that never moves.
And the refusals are the part we would defend hardest. An agent cannot vary the tool contracts, cannot amend the disclosure rules, cannot lower a confirmation gate, cannot reach outside its granted scopes — not because a rule says so but because the assembly puts those facts where identity data cannot express an opinion about them. The platform half is the same for everyone precisely so that the identity half can be anything. That is the trade that makes user-authored agents shippable at all: creativity above the line, invariants below it, and the line drawn at mechanics versus opinion.
Postscript, August 2026. The split held, and its most instructive aftermath is that the line itself turned out to be alive. Per-agent preferences joined the record days later (a third body beside identity and style), and months on, a block originally classified as chief-of-staff identity — the doctrine of capturing a user's corrections as durable preferences — was reclassified as platform, because the storage change had quietly changed its nature: once every agent held its own preferences, "learn what this user wants from you" stopped being one character's habit and became a capability of being an agent here. Mechanics-versus-opinion survived as the criterion; where a given block falls under it is re-decided by the architecture around it. The first user-created specialists have since been joined by org-shared agents and installable kits, all riding the same three fields this week put in a database — and the flagship assistant still has no code branch to its name.