Three atoms turn stateless AI
into a colleague.
Capabilities are signed, typed callable contracts — the only way our agent produces facts. Cases are durable working memory that persists across sessions and audit-logs every action. Goals are standing directives the agent pursues between your prompts.
Signed, typed, callable contracts.
Durable working memory, append-only event log.
Standing directive with success criteria.
Stateless AI breaks at three places.
ChatGPT Teams, Copilot, Glean, custom RAG — they all share the same shape: a chat box that takes a prompt, generates a paragraph, forgets when the tab closes. A colleague has memory, commitments, and doesn't make things up. The architecture has to deliver these by construction, not by prompt-engineering.
No memory of company state
Every conversation starts from zero. The agent doesn't know what's currently in flight, who owns what, what was decided last week.
No commitment to outcomes
The agent answers the immediate question. It has no concept of standing objectives. It cannot pursue work between prompts.
No structural prevention of hallucination
Even RAG-with-citations is the LLM reading prose and generating prose — the interpretation step is where freelancing happens.
Ctrl AI's answer: three atoms — Capability, Case, Goal. Skills, memory, direction. Everything an agentic company needs.
Skills. Memory. Direction.
Adding more primitives multiplies complexity without adding expressiveness. Three atoms cover the structural decomposition; a fourth would be a feature catalog, not a deeper architecture.
How do we do this?
One specific thing the AI is allowed to do — written like a job description: typed inputs, typed outputs, signed by a real person at your company.
- Language
- Verb (the action)
- Management
- SOP / runbook / signed function
What is happening?
A structured object representing one in-flight decision — Hire #42, Loan #1234, Renewal Acme. Append-only event log doubles as the audit trail.
- Language
- Noun (the instance with state)
- Management
- Project / engagement / ticket
Why and toward what?
A standing directive. The agent surfaces it on every relevant turn, fires triggers as the deadline approaches, links new Cases as they emerge.
- Language
- Predicate (intent toward future state)
- Management
- OKR / objective / sprint commitment
The HOW — signed, typed, callable.
Every Capability has six parts. Inputs and outputs are typed. The implementation is one of five kinds. A real person at your company signs it. When something goes wrong, the named signer is the escalation path — not a vendor.
Sarah+Markdual-signed (destructive)Five implementation kinds
The WHAT-IS-HAPPENING — durable working memory.
A Case is a structured object representing one in-flight decision: a hire, a deal, an escalation. Every Capability invocation that touches a Case appends a CaseEvent. The audit trail is not a sidecar — it falls out of the architecture.
| Name | Sarah Chen |
| Start Date | 2026-06-01 |
| Team | Finance |
| — | |
| Laptop Status | — |
| JIRA Account | — |
| Welcome Kit | — |
- Day 0createdagentHire(Sarah Chen) · start 2026-06-01 · Finance
- Day 0invocationprovision_emailagent→ schen@acme.com
- Day 0invocationorder_laptopagentlaptop_status: ordered
- Day 1progress noteuserSigned offer letter.
- Day 4gate decisionprovision_jira destructiveagentdestructive — gate fired, approver: ⌃ Sarah
- Day 4gate decisionuserapproved
- Day 4invocationprovision_jiraagentJIRA account created
- Day 7invocationsend_welcome_kitagentkit dispatched · receipt #6184
The WHY — a standing directive the agent pursues.
A Goal commits to an outcome by a horizon. Success criteria are structured. Some carry an expression that auto-evaluates after every relevant Capability invocation — so the agent measures progress without you typing a thing.
Hit Q3 revenue target $4.5M ARR
Quarterly revenue commitment. Closes a mix of new logos and expansion. Due Sep 30, 2026.
outputs.forecastArr >= outputs.targetArr * 0.8lookup-crm-pipeline-summary · summarize-renewal-riskThe natural hierarchy
Goals surface. Capabilities act. Cases remember.
User opens /ask. The prelude already knows what's in motion.
SarahnotesYour active goals:
- Close Q3 books by April 5 · 3 days · 71% complete · 7 unmatched invoices
- Onboard Mark Liu by April 12 · 8 days · 30% · laptop ordered, JIRA pending
- Hit Q3 revenue target · 64 days · forecast 84% of target · 5 deals in pipeline
Highest-leverage right now: 5 of the 7 unmatched invoices fit our standard reconciliation pattern. I've drafted resolutions, awaiting your sign-off. Approving moves Q3-close from 71% → 90%. Want to walk through the 5 quick approvals first?
"The LLM produces only prose narration. Every factual claim traces back to a typed Capability invocation, cited inline. The synthesis turn is rhetoric, not knowledge."
This is the rule that makes hallucination structurally hard rather than statistically less likely. Capabilities are the only source of fact. Every claim ships with its trust level visible.
/ask is just the simplest mode.
The same three primitives serve every shape of work — proactive agents, multi-step procedures, cross-department reasoning, the company as a typed API for other AI tools.
Triggers
Capabilities fire on cron, events, thresholds, webhooks, and goal-state. Proactive agents that don't wait to be asked.
Long-running cases
Multi-session decisions accumulating in a Case. Pick it up in any session — full provenance is there.
Cross-system orchestration
External writes through external_action Capabilities — every destructive step pauses for human approval via Slack magic-link.
Multi-agent
Department agents call each other through consult_agent. Multi-department reasoning, every step signed.
Self-improvement
Coverage-gap signals propose new Capabilities. The catalog sharpens itself — daily.
Company-as-MCP
Your verified, non-destructive Capabilities project as MCP tools. Claude Desktop, Cursor, Code — they all call your governed contracts.
Stateful + directed + verified.
None of the four feature buckets is novel in isolation. The combination is the architecture.
| Concern | ChatGPT Teams / Copilot | RAG / Glean | Custom agent frameworks | Ctrl AI |
|---|---|---|---|---|
| Memory across sessions | ✕ | ✕ | ~ | ✓Cases hold typed state + event log |
| Standing objectives between prompts | ✕ | ✕ | ✕ | ✓Goals drive selection, triggers, prelude |
| Hallucination prevention | ✕ | ~ RAG cites prose | ~ tools but no governance | ✓Capabilities are the only fact source |
| Audit trail | Conversation history, brittle | Citation refs, brittle | Logs | ✓Cryptographic receipts + Case events |
| What the AI is allowed to do | Implicit | Implicit | Tool list, unsigned | ✓Finite catalog of signed Capabilities |
| Action vs answer | Mostly answers | Answers only | Acts, no governance | ✓Acts on triggers · destructive ops gated |
Three primitives. Three plans.
Every plan ships Capabilities, Cases, and Goals. You pick the governance depth.
Starter
Solo founders + small teams getting their first 20 Capabilities signed.
- ✓Up to 50 signed Capabilities
- ✓Cases + Goals, full audit log
- ✓Public Trust Portal
- ✓Standard data connectors
- ✓Inference at pass-through cost (no provider account needed)
Professional
Operating teams: Triggers, MCP server, BYOK, dual-signature.
- ✓Everything in Starter
- ✓Triggers (cron, threshold, webhook, goal-state)
- ✓Public MCP server endpoint
- ✓Dual-signature on destructive Capabilities
- ✓BYOK (Anthropic, OpenAI, Gemini)
- ✓Self-improvement aggregator
Enterprise
Regulatory-grade. VPC, on-prem, sector compliance, dedicated CSM.
- ✓Everything in Professional
- ✓On-prem or VPC deployment
- ✓SOC 2 Type II · Basel III · sector-specific
- ✓Domain-level access control + data residency
- ✓Custom connector development
- ✓SLA + dedicated CSM
All plans include AES-256-GCM encryption at rest, audit logging, and Ed25519-signed receipts anchored to a transparency log.
Frequently asked questions
Skills. Memory. Direction.
Sign your first Capability, open your first Case, commit to your first Goal — in a 30-minute trial.
14-day free trial · No credit card required