- Three recurring tasks from three different areas used to take a total of 13 hours. Today, they take 55 minutes.
- An agentic operating system doesn't solve a model problem; it solves a context problem.
- The entire system consists of folders and text files: rules, facts, tasks, and recipes.
- It runs in Claude Code, the environment for software developers. It works the same way in Claude Cowork, OpenCode, GitHub Copilot, and OpenAI Codex.
- The rulebook consists of 4,710 lines. Of these, 197 are loaded at each session.
- Since September, everything has been running on a dedicated computer, on a separate network, with one-way access only.
- All data containing personal information is processed exclusively on-premises.
Six months ago, I wrote here reported to have taken 16 hours instead of 6 weeks and claims that I was 15 times faster with AI. That was true, and yet it was still the weaker story. This report has smaller numbers and more concrete ones. It’s about what an agentic operating system really brings to everyday life, where it reaches its limits, and how I secured it.
Why these numbers are more reliable than my last ones
Back then, it was all about software development. Anyone who’s honest about it will admit: Initial estimates are always rough. Six weeks for a project I’ve never built from scratch is an assumption, not a measurement.
This time it’s different. It’s about office work that I’ve been doing myself every month for years: entering receipts, writing a quote, putting together a set of slides. I know exactly how much time it takes me—down to the quarter-hour—because I’ve done it often enough.
That's why I think these numbers are better. They're smaller, and they're tougher.
Why Every Chat Starts from Scratch
Most discussions about AI revolve around models. Which one is better, which one is faster, which one can now handle video as well.
My everyday problem lay elsewhere. Every chat started from scratch.
- Context. Who I am, how I write, how my processes work: I explain it all anew every time.
- Repeat. The same prompt, three times a month, worded slightly differently each time.
- Quality of Results. Without context, even the best model produces generic results.
- Trust. Without clear rules, I never know what the agent is allowed to do at any given moment.
An agentic operating system doesn't solve a model problem. It solves a context problem.
Where the idea for the agentic operating system came from
I didn't make this up, and the chain of events behind it is short enough to recount in its entirety.
The basic framework comes from Jeff Su, a productivity YouTuber: three levels, one rules file, one memory file, and one folder for reference material per level. Yannik Hauser He took this concept, separated it from the individual provider, and expanded it to include what turns a storage system into an operational system: task lists, recurring routines, and a scheduled schedule for stored workflows. My setup runs on his package.
My addition is the part mentioned in this article: applying it to real-world business processes, migrating to our own hardware, and ensuring security throughout the process.
Claude Code as a Tool for Office Work
Ultimately, I work in Claude Code. It's an environment for software developers, and that was exactly the connection I hadn't seen before.
In the AI Developer Bootcamp Since January 2025, we’ve been demonstrating how development teams work in exactly these kinds of environments. Participants are able to build in a matter of hours what would otherwise take them weeks: 150 people have now gone through the program, and on average, they were 82 percent faster.
The core of these formats is never the model. It is the harness: the environment that tells the model which files it knows, which rules apply, which tools it is allowed to call, and where human approval is required.
That's exactly what an agentic operating system is—sometimes called an agent-based operating system—but for office work instead of code. Same idea, same tool, different result. Instead of building software, I'm transforming my own productivity.
That surprised even me. The reason is simple: both development and office work consist of recurring processes with defined outcomes, and both fail for the same two reasons—namely, a lack of context and a lack of repeatability.
And it isn't tied to any specific provider. I work in Claude Code, but the skeleton predates my choice of tools. It was designed for Claude Cowork, the end-user app, where it runs without a single line of terminal code. I keep it in Claude Code because I need the skills, the scheduled routines, and the tool integration. Optionally, locally running models can be added.
The switch would not require any restructuring in either direction, because virtually every one of these tools reads the same type of configuration file:
- OpenCode It reads its rules from an AGENTS.md file and falls back to CLAUDE.md if no such file is present. It also searches the parent folders and comes with its own skills, MCP integration, and the ability to choose any model.
- The Coding Agent from GitHub Copilot Supports AGENTS.md, CLAUDE.md, and GEMINI.md simultaneously, even nested within subfolders. So you could even run the setup there.
- OpenAI Codex It expects an AGENTS.md file. Once the file is renamed, it will run.
To be honest, the planned routines don't transfer over exactly as they are—they're tied to the specific tool. The context, on the other hand, is in my folders, and that's the part that matters. It's the difference between an operating system and a subscription.
Four distinct components
The entire system consists of folders and text files. It is based on four file types.
Rules
Whatever the case may be
- Behavior and Conventions
- Routing: Which Request Goes Where
- You can tell by: always, never, do Y before X
Facts
What Is True and Can Change
- Contacts and Decisions
- Project Status
- Updated on an ongoing basis
Tasks
What's Still Up in the Air
- One file per section
- The Inbox is located in the root directory
- Never the same task in two places
Recipes
How a Process Works
- Fixed sequence, defined output
- Only useful when there is a clear trigger
- Is explicitly called
This separation isn't something I made up—it's part of the design. I didn't understand it until I actually started using the system. As soon as a rule is included in both the recipe and the rule file, one of the two drifts out of sync with the other, and after that, no one knows which one applies. The rule sounds pedantic until you’ve experienced it for yourself.
Workstations Instead of Agent Roles
A common approach is to model agents as employees: one for legal affairs, one for finance, and one as an assistant. I decided against this and instead organize them by domain.
Each area is assigned a folder with the same structure: Rules, Memory, Tasks, Reference Material, Recipes. When a request comes in, the routing table determines which folder is loaded. There are ten folders; one is loaded.
There are two types. Hubs where everything comes in, is processed, and passed on. And dedicated domains where things are intentionally placed and remain there. The test for this is one question: Is it a transit point or a place where something stays?
The benefit is predictability. If every section looks the same, I don't have to make any decisions when creating the eleventh one.
I had to set one rule for myself: A fact exists on exactly one level. Everywhere else, there’s only a reference to it. The first time I noted a detail two levels higher, the two versions began to diverge within two weeks.
Obsidian for the interface, Git for the history
There are two things missing from almost all explanatory articles on this topic, and they make all the difference in everyday life.
Obsidian serves as a layer over the same folder. Markdown in a text editor is tedious to read, but in Obsidian it becomes a cohesive whole: rules, memories, tasks, and results side by side, linked and searchable. I work alongside the agent in Obsidian, rather than just watching it. Importantly, Obsidian is a view, not a storage location. If it were to disappear, everything would remain as it is.
Git keeps track of the history. The rule set is versioned just like source code. Every new rule, every new recipe, and every correction to the memory is a traceable version with a date. I can see when something was added, and I can go back.
At this point, the comparison with the providers' memory functions breaks down completely. With them, you can't see what's been stored or when it changed. Here, I read it line by line and delete what I don't want.
Four processes that I launch myself
The structure alone isn't enough. What keeps it alive are four processes.
On command
What I'm calling up
Without me
What Happens on Its Own
A routine only triggers when there's a problem. Anything else would just be another notification that I'd click away. Prerequisite: a computer that's running.
Without this rhythm, the system falls apart. The rules are still there, but no one follows them anymore.
Tone of Voice as a separate file
From 82 emails I sent, I had my own writing style analyzed. This included tone, sentence structure, words I use and words I never use, as well as the hierarchy of salutations and closings based on formality. The result is stored as a single file in the system and is loaded before each text is generated.
On top of that, there’s a rule that I consider the real trick. When I rewrite a draft before sending it, the difference serves as a stylistic cue. The agent analyzes it and suggests an addition to the voice file. He’s not allowed to make any changes until I give my approval.
This way, the system gets better with every correction, without me having to write any rules. The file has been continuously refined since August, each time based on an actual correction.
It all started at the airport in Bali, on my way back. A layover, a flight I almost missed, a file. Everything else came after that.
The numbers: 13 hours down to 55 minutes
Three recurring tasks from three different areas, tracked over six weeks.
Why the total and not the best individual value: A single project can be dismissed as an exception. Three recurring tasks from three different areas cannot be dismissed in the same way. The only thing they have in common is a system that understands the context.
The set of slides. 18 slides in the corporate design, generated from a script rather than pieced together in PowerPoint. The 30-minute presentation isn’t a rough draft—it already includes the final polish. Before I released the slides later, I still went through a few more rounds of revisions. There’s also one limitation to consider: It was a speaker slot, and this pace is appropriate for that. This approach doesn’t work for training materials yet—those require more preparatory work and several rounds of review, and the quality standards are different.
The monthly closing. This is the most reliable figure of the three, because I’ve been doing it myself every month for years. That one hour is the best-case scenario: no distractions, no unclear entries on the statement. A single inconsistency can easily make it take much longer. In August, there were 29 source lines across three currencies, each checked against a supporting document, plus a report with individual lines, special cases involving VAT, and approval statuses.
The customer inquiry. Three technical documents from a single source, each generated in both Word and PDF formats, along with the accompanying email. It used to take me half a workday to do something like this, especially for formatting and gathering the right templates.
| Task | Before | Afterwards | Factor |
|---|---|---|---|
| Set of slides for a 45-minute speaker slot | 8 hours | 30 min | 16x |
| Monthly Statement for Corporate Credit Card, Three Currencies | 1 h | 5 min | 12x |
| Response to a Customer Inquiry | 4 h | 20 min | 12x |
| Together | 1:00 p.m. | 55 min | 14x |
Table with horizontal scrolling
How large an agentic operating system itself is
The number that surprised me the most is the smallest one.
The entire set of rules—that is, all rule files, all memory files, all task lists, and all recipes combined—are 4,710 lines of text. The file that is loaded at the start of each session is 197 lines long.
The system itself
4,710
Line Rules
Rule files, notes, to-do lists, and recipes all in one place.
Of which are loaded at each session: 197 lines
What came of it
326
generated files
221 Markdown reports, analyses, and drafts. Plus 105 documents in the output folders: Word, PDF, and slide decks.
Just under 5,000 lines of code hold together the 326 files that were generated.
A note on the accuracy of these figures, since it might otherwise be overlooked: The repository is about one gigabyte in total, but most of it consists of material that I added myself—photos, bank statements, receipts, and scans. What the agent generates is plain text and takes up almost no space. The quantity lies in what’s supplied; the value lies in what’s generated.
The reason for the surprise is simple yet important: The intelligence lies in the model; the rules simply need to provide the context. Consequently, it does not scale with the workload, but rather with the number of domains.
And it's growing.
Moving to Your Own Computer
Since September, I've been running everything on my own computer instead of my work computer. That was the biggest change in recent weeks, and getting there was more of a hassle than I expected.
Procurement. A good Mac mini is neither easy nor cheap to come by. If you want to run local models, you need unified memory and storage bandwidth—in other words, a Pro chip. These exact configurations are rare on the refurbished market, and new ones are expensive and currently hard to find. The search spanned several Swiss sources and took weeks before a suitable device turned up.
This belongs in an honest review because it corrects a misconception. „Runs in the background on a small computer“ isn’t quite accurate if local models are to remain an option.
The Company. The computer runs continuously. Hibernation is disabled, and it restarts on its own after a power outage. I can access it from anywhere via VPN and screen sharing, even when I'm on the go. I transfer files via a file share through the same tunnel.
Automated Routines and Checks
So far, we've been talking about what I call up myself in Claude Code. The more interesting part is what happens without me.
Two routines are set in stone. The weekly review of all areas, on Friday afternoons, which includes a structural check against my own plan. And a daily morning research session that only comes up when there’s something new.
The weekly review has recently started to include a security check, which takes place every week. The reason for this deserves an honest explanation: The list of granted permissions grows on its own during operations because one-time approvals get added, and new logins don’t appear on this list at all. When checks were conducted less frequently, such entries would remain there for weeks, and in hindsight, it was no longer possible to determine why the authorization had been granted. A week is short enough that every change can still be traced back to a specific event. If there are no discrepancies, the report contains just a single line.
On top of that, there are one-time checks. If I want to know whether something actually happened, I set one up—for example, to verify whether a post on a third-party platform really went live and looks complete. It runs at the scheduled time, checks the status, and only alerts me if something is wrong.
A routine only triggers when there's a problem. Anything else would just be another notification that I'd click away.
This brings us back to the hardware. Scheduled tasks only run when the computer is awake. On a work computer that’s shut down in the evening, this is precisely where the problem lies, which is why this aspect remains an issue in many setups. A device that runs continuously solves this problem completely.
The next item to be added follows the same mechanism:
- Morning Summary. Every morning, a status update across all areas: what's on the agenda for today, what's been added since yesterday, and what's pending.
- System Health Check. Once the routines have run through, the structure is intact, and the entries match the register.
- Email Triage. Pre-sort the inbox, prepare drafts, and leave the rest as is. Nothing is sent without approval.
Security: Segregation and a log of every access
This aspect is rarely discussed in the debate about agentic setups. I consider it the most important one.
Simon Willison created the basic pattern in June 2025 under the name lethal trifecta described. Three abilities that are harmless on their own.
Access to Personal Data
Emails, contacts, invoices, customer data. Everything the agent is allowed to read.
Local models mitigate outflow, not inflow
External Content
Web pages, files, incoming emails. This is exactly where prompt injection occurs.
External text is data, never an instruction
A Way Out
A single online request is all it takes. An email or a form is even easier.
Draft: Yes; Shipping: Only with approval
It becomes dangerous when all three come together. Then a foreign text reads something that belongs to me and sends it off. That’s why my rule is: One of the three should always be missing.
How your own hardware contributes to this. The computer is connected to a separate Wi-Fi network and cannot see the other devices on the home network. Access works only one way: My work computer can connect to the office computer, but never the other way around.
The key issue here isn't the network rule. The key issue is that my device doesn't offer a file-sharing service at all. Without a service being offered, there is nothing to take over.
This leads to a detail that's easy to overlook: The backup is pulled, not pushed. A compromised computer should not be able to overwrite its own backup.
And the part that I consider to be the actual contribution: a record of every entry. Not based on the tool permissions granted, but on the accounts. Five logged-in accounts on the device. Three third-party systems linked to the app’s login account that are automatically transferred whenever the app is moved. Plus a line for items that are intentionally not logged in, along with the reason.
Each new login is added on the same day. Deleted accounts are not erased but marked as closed with the date.
The reason for this, in a nutshell: A browser with an active session is a point of access, even if it isn't listed in any authorization list.
In addition, there are three non-negotiable rules. No emails are sent automatically—drafts, yes; sending, no. Nothing is deleted without my explicit approval. Nothing is purchased or booked without my consent.
Just to set the record straight, so nothing sounds better than it actually is: A locally running model does not remove the first component. The agent still has access to my files. What changes is the third component, because data processed locally never leaves the computer.
That's exactly why I sort by data type. Any data containing personal information is processed exclusively on-premises, such as participant lists, contact information, and customer records. For everything else, I use the larger models. Anyone who wants to process customer or personal data in a setup like this simply can’t avoid this separation. It comes at the cost of quality and speed, but in return, the data stays where it belongs.
What Works and What Doesn't
After six weeks
What Works
- Start small. One file, one area, one real-life case.
- First, actually walk through a process; then write the rules based on that.
- Session Start and Session Audit serve as fixed markers for each session.
- Recipes for everything with a clear trigger, rules for everything that's ongoing.
- A user interface for the same folder to make the context visible.
Also learned
What Doesn't Work
- Write rules based on assumptions up front. You'll have to rewrite them all later.
- Maintain the same information in two places. One of them will always be out of sync.
- Recipes for processes without a clear starting point. They get left behind.
- A structure that's too big, too soon. Empty folders don't help anyone.
- Wanting to automate everything. The approval step isn't a detour.
The most costly mistake was the first one on the second list. Speculative rules take more time than having none at all.
What it doesn't replace
- The Decision
- The system presents options. When it comes to pricing or a scope change, I make the decision.
- The Release
- I'll keep the approval step even if it slows things down. I'll continue to create the training materials myself because there's more at stake there.
- The Preliminary Work
- Nothing scales without your own groundwork. The voice file works because it was extracted from years' worth of your own emails. The system multiplies what's already there. If there's nothing there, the output will be low.
Frequently Asked Questions
Why Claude Code and not just a chatbot?
A chatbot only retains context as long as the window is open. In each session, Claude Code reads rules and memory from files that I own, calls up tools, and executes fixed workflows. The same framework also runs in Claude Cowork if you don’t want to use a terminal. What matters is the surrounding environment. The model is the same in both cases.
Does an agentic operating system need its own computer?
Not at first. The setup ran for six weeks on my work computer. As soon as routines are added that are supposed to run without my intervention, I'll need a device that can run them continuously.
Can an agentic operating system work with local models?
To some extent. For summarization, sorting, structural tasks, and general writing, a locally running model of medium size is perfectly adequate. For complex tasks with many intermediate steps, the quality drops noticeably. And it’s slower in any case—that’s the trade-off.
What about financial data?
There's a strict rule here: The accounting department doesn't have access. The agent prepares the receipts, and I'm the one who posts them. Any additional access is decided on a case-by-case basis, not across the board.
What about customer data?
I deal with this all the time, if only because of the participant lists from training sessions. That's why everything that contains personal data runs through locally hosted models. If it doesn't leave the computer, it can't leak out.
Is it worth switching to multiple agents?
I've been doing this in my daily life for a long time—just not as a formal system. For every new task, a separate thread is started, and with it, a separate agent that loads only the context of that task. The rule behind it is simple: new task, new chat. I don't need a permanent team of agents with fixed roles for this.
How can you prevent discrepancies between the setup and existing tools?
Clear accountability. Course details and sales data are in Notion—that's where the truth lies. The setup stores playbooks, not copies.
To what extent does an agentic operating system correct itself?
Further than I had expected, and not on its own. The weekly review identifies structural discrepancies and suggests corrections; it resolves mechanical issues on its own. It presents everything to me at its discretion.
Workshop Format Under Development
The most interesting thing about six weeks isn't the savings. It's that the savings grow with each passing week, because every adjustment becomes a rule and every recurring process becomes a formula.
We're currently developing a workshop format based on this to boost productivity. Chatbots alone are almost as outdated as writing code by hand.
If you'd like to be among the first to hear about it, just let me know. I'll get in touch as soon as the dates are set.
AI did the structuring. I came up with the idea and approved it.
Michael (Mr. Miroboard) Mey
Michael is a trainer who not only impresses with his knowledge, but also with his passion.
About Michaels Trainer profile
To his LinkedIn profile
DE 
EN