Introducing Qoni — managed infrastructure for AI agents in production.

A question worth answering properly

Models get smarter every generation, and more teams are building agents than ever. Getting a demo running takes an evening now.

The next step is the hard one. So this piece tries to answer one question properly:

How do you build a production-grade agent?

Writing the core business logic is only the start. To send an agent into production — to have it work like a reliable digital colleague — you need to give it three more things.

First: an identity of its own

Thirty years of identity protocols — from enterprise directories to single sign-on to federated login — all assume the subject is a human. So most agents today borrow a human's identity to get things done: an employee's API key, a shared password. Nobody minds in a demo; in production it's three questions in a row: when something goes wrong, was it the person or the agent? It only needed to do one thing — why does it hold everything this user can do? And what, exactly, allowed this call?

And there's a deeper issue: the smarter the model, the more likely it is to go off-script. More capability means a larger blast radius. The stronger the intelligence, the more it needs boundaries.

Give the agent a clear identity of its own — independent of any human — and the benefits are concrete: every action is attributable (it acted, and on whose behalf); every permission is revocable (grants work like visas — scoped and time-boxed); every record reconciles with how the company already manages human identity.

In one line: the agent stops being a shadow with borrowed papers, and becomes an employee with a badge.

Second: a browser, and a runtime where it can act

An agent that can only talk isn't productive yet.

Human productivity lives in tools: browsers, operating systems, applications. Agents are no different — give yours a browser and a runtime of its own, so it can plan and act autonomously: open pages, fill forms, verify results, retry on failure.

That's when an agent starts producing like a person: not just helping you think, but doing it for you.

Third: memory, layered like a human's

A production-grade agent must also understand the person it serves.

Human memory is layered: things that just happened, patterns worked out over time, preferences we can't quite articulate. And we remember what people did, not just what they said. We even sort the day's experiences in our sleep — and wake up with insight.

Agent memory should work the same way: processed in layers rather than logged as a transcript, covering behavior as well as conversation — and ideally able to dream: digesting experience in idle time into deeper understanding.

These three things are Qoni

Today, we're introducing Qoni.

We built Identity → Action → Memory as one managed runtime. Qoni isn't asking you to reinvent these wheels — it packages these three things into a secure, governed, bounded environment, so the model's intelligence gets amplified safely and building agents becomes faster, simpler, and cheaper — agents that carry their own identity, their own way of acting, their own memory, and stand on the web as first-class citizens. It's our continuation of Tim Berners-Lee's line: this is for everyone.

The brilliance comes from the model.

The soul — identity, action, and memory, unified — comes from Qoni.

01 · Identity — GenAuth

Every generation of identity technology has answered the same question for its era: why should this new actor be trusted? In the LAN era, AD/LDAP and Kerberos answered "who is the person at this machine." In the web era, SAML and OAuth 2.0 answered "why may this app act on my behalf." Then OIDC carried identity across apps and devices. Thirty years, five generations of protocols — and the subject was always a human.

Now it's the agent's turn. Researchers break the attribution layer of agent infrastructure into three questions: Agent IDs — who is this agent; identity binding — which person or organization stands behind it; certification — can its behavior and properties be trusted. OAuth and OIDC answer none of these: OAuth lets a human authorize an app, OIDC lets an app recognize a human — but no protocol yet lets the world recognize an agent.

GenAuth productizes those three questions into the identity layer for agents. Every agent gets a passport — an independent Agent ID with its own accounts and credentials, and a full lifecycle of registration, rotation, and revocation. It is bound to a human through identity binding — every action attributable to the person who delegated it; nothing is an orphan incident anymore. On the existing rails of OAuth 2.0 / OIDC, it extends a delegated authorization chain — short-lived credentials whose scope only narrows, never widens. And since an agent's power comes from its tools, MCP tool calls fall under the same identity and audit governance. All of it, one SDK away.

Four core principles: predictable, governable, revocable, traceable.

Security engineering calls this narrow-only design the principle of least privilege; game theory calls it a commitment device: the boundary isn't there because we distrust the agent — the boundary is what makes it trustworthy. Identity technology has traveled thirty years; this time, at last, the subject is the agent.

02 · Action — Web Agent

Take stock of where productivity happens — for humans and agents alike, some 90% of it runs through the web and a browser.

So you've probably tried giving your agent a browser — and found that typical browser-use setups are slow, expensive, and not accurate enough: fine in a demo, scary in production.

Web Agent's answer is hosted execution: the agent's entire loop — open a browser, observe, decide, act, retry — runs in the cloud; you don't keep a single browser alive. One API lets your agent do anything on the web through a browser — fast, accurate, and cheap to run.

Every capability ships as an API with a clear job: search and deep research — multi-source retrieval, cross-checked, returned with citations; web operations — logins, forms, checkouts, full multi-step flows; Track — set a goal and a cadence, get notified the moment a page changes, no 3 a.m. babysitting; session reuse — sign in once, and later tasks carry the login state until the site asks again.

"Fast and accurate" isn't a slogan — it's an engineering bar: P90 task completion within two minutes, with success rates pushed toward 99%, ground out by replaying real user tasks, round after round, until it holds.

Two examples:

• Social-media automation and data collection: multi-platform publishing, comment monitoring, competitor tracking, public-data aggregation — one sentence, and the agent runs it.
• Enterprise data collection and governance: not every company has a lakehouse and clean, standardized APIs. Real companies are full of scattered, non-standard, hard-to-maintain legacy systems and data pages — no API, but there's always a web page. Web Agent uses the browser to bring those unreachable systems back within reach.

When a step needs a human — a login, a QR code, a CAPTCHA — the agent hands you the browser: you finish that step, and it resumes from the breakpoint, task unbroken, context intact. Every run is recorded; every step can be replayed and archived — when something goes wrong, you don't guess, you rewind.

03 · Memory — GUMem

The industry has reached consensus: an agent without memory meets you for the first time, every time. But most "memory layers" only do half the job — extract the chat, store it, search it back later.

GUMem does the other half too:

• Two tracks: conversation and behavior. Not just what users said, but what they did — what they clicked, chose, abandoned. Behavior is often more honest than words.
• A multi-layer memory pipeline. Conversations → facts → summaries → topics, distilled layer by layer — the higher the layer, the closer to who this person is. Every memory carries its source, confidence, and time decay.
• Recall that plans. Retrieval isn't a single vector lookup: a query agent breaks the question apart, gathers evidence across memory types, and assembles just enough context — and when the evidence runs out, it says so instead of guessing.
• AutoDream insights. Like a mind sorting the day during sleep, GUMem digests accumulated behavior in idle time into deep, personal insights — "tends to order late at night," "has been watching Tokyo flights for three weeks." Not a pre-built report: the agent decides what to analyze, writes its own analysis code, and runs it to a conclusion.
• Formation you can watch. Memories don't grow in a black box: you can observe, in real time, how each one is distilled from conversation and behavior — like watching it take shape.

And all of it belongs to the user: visible, editable, deletable. Memory belongs to the user, not the model. On LoCoMo, a long-conversation memory benchmark, GUMem scores a state-of-the-art 92.9% — the badge is public on Qoni's site.

From one agent to a hundred

When every agent has an identity, a permission boundary, and a full audit trail, something changes —

you can finally go from running one agent to confidently running dozens — even hundreds — each doing its own work. If anything goes wrong, you can trace it and stop it, instantly.

The bigger the fleet, the safer and more controllable it gets.

Safer. Stronger. Yours.

When an agent has a soul

We believe the web of the coming years will be home to agents in the hundreds of millions. They'll book the trips, watch the markets, run the workflows — a real share of the world's work, done on our behalf.

That world can take two shapes. One is chaos: countless nameless automations charging around on borrowed identities, no one sure who is doing what. The other is order: every agent with a name, a boundary, and a place it came from — brilliant, and worthy of trust.

We're building the second one.

"Give your agent a soul" isn't a romantic line. It's literal: an identity, so it can be recognized. Boundaries on its actions, so it can be trusted. A memory, so it can be entrusted. A soul is everything "trustworthy" means.

Tim Berners-Lee said: this is for everyone. We want to carry that sentence one step further —

The Agentic Web should be for everyone, too.

Now

Qoni is in private build.

Join the waitlist — one email when it's your turn. Nothing else.

Give your agent a soul.