What an agent runtime is, and why open source matters

The layer under the loop

An agent runtime is the isolated machine an agent's code runs on, with the rules that machine enforces over its files, processes, credentials and network calls. Credal draws the boundary in almost those words: "an agent harness is the application-layer scaffolding that turns a model into an agent. An agent runtime, meanwhile, is an infrastructure-layer execution environment where the agent actually runs." The harness lives inside the machine. The machine is the part you keep.

The vocabulary is younger than the products wearing it. LangChain's taxonomy post concedes that "I don't think there is yet a super clear definition of any of these." Work-Bench describes the layer by what it does: the infrastructure built to "safely execute, constrain, observe, and improve agent work at scale". The same report finds 57% of companies with agents in production (G2, 2025) and 65% of leaders naming agentic system complexity as the top barrier (KPMG, Q4 2025). Guild.ai's glossary settles on the operational half: the execution infrastructure that manages an agent's lifecycle, state, compute and interactions.

Three different things get sold under the one word: the loop that decides what the agent tries next, the machine that executes the decision, and the record of what happened. Most comparisons weigh the loop, because it demos well and swaps out in an afternoon. A purchase turns on the other two, which you live with for as long as an agent touches production.

What the label leaves out

An orchestration library gives you the pieces of the loop and leaves the machine to you. A harness is the finished loop. It assembles the prompt, calls the model, runs the tools and writes the transcript, and a Kortix session carries one inside its sandbox. A model gateway authenticates model calls, routes them to a provider and counts what they cost. None of the three decides which files the agent may open, which credential reaches it, or what happens to a process that hangs.

The layers get conflated because products bundle them. Credal says so plainly: "many frameworks ship both layers in a single bundle." Bundling is convenient in week one. It gets awkward at review time, when a security team asks which component enforced the rule it is reading about. Agent runtime vs agent harness takes the split apart function by function.

Six things every runtime holds

• A machine.A computer the agent gets alone, with an operating system it can install into and a boot it can repeat.
• A filesystem.The disk that machine mounts, including the working copy of your repository and everything the session writes.
• A process.The processes the agent starts, and a way to end them when the turn is over.
• Credentials.The keys for connectors, repositories and models, and the reach each one carries.
• A scheduler.A clock and a wake-up path, because triggered and scheduled work has to start without a person.
• Permissions.The rules that decide which of the other five the agent may touch, and who may change them.

Score a product on those six and the category sorts itself. Something that holds only the machine and the process is a sandbox. Something that holds only credentials is a gateway. Agent runtime architecture shows how the six are wired together in a working stack.

A sandbox runs code, and a runtime answers for it

Sandbox providers have become good at the first half, and their own pricing pages show where they stop. E2B bills per second of running time. Hobby carries a one-time $100 usage credit and caps sessions at one hour, and Pro goes to 24 hours (checked October 2026). Amazon Bedrock AgentCore goes further. It measures a session "from microVM ready, initialization, active processing, idle periods, until session termination", and reclaims idle memory after 120 seconds in Runtime v2. Sessions last "up to 8 hours for each lifecycle on microVMs, or up to 14 days on Instances", as the AgentCore session docs put it.

That extra machinery is lifecycle and accounting, which is real work and worth paying for. Neither pricing page promises a rule that stopped a tool call, or a record a reviewer can read six months later. Those are the two things a runtime answers for, and they are why the word carries weight in a procurement conversation.

Kortix is the open-source AI Operating System, and the machine, the harness and the record ship together. One isolated sandbox per session. Each session has its own isolated machine and branch. Session work reaches main through a change request. Merge is default-deny for agents. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan. The test for any runtime is whether that record can still be read after the machine is gone, and for how long.

Four questions that classify any product

Ask these on the first call, before a demo.

1. What does it own? A machine with its own kernel and disk, or a process inside somebody else's operating system.
2. What can the agent reach? Name the credentials, connectors and hosts, and say where each one is stored.
3. Where are the rules written, and who can change them? A file in your repository, reviewed by a change request, is a different answer from a settings page only an admin can see.
4. What can you read afterwards? A transcript, a diff, an audit export, and how long each one survives.

A product that answers all four is a runtime in the narrow sense of the word. The answers also make quotes comparable: two vendors can bill the same per second and land on opposite sides of questions three and four. How the current products answer them is the next read.

What the rules look like when they are written down

Those six lines of frontmatter are the whole constraint set for one agent. It sits in agents/support.md in the repository, not in a settings panel. permission: with bash: ask means every shell command that agent tries waits for a person to approve or reject it. The grants that decide which connectors, secrets and Kortix permissions the agent may use are declared in kortix.yaml. A change to either file takes effect when it lands on the default branch, so the diff is the review.

That is where an open-source runtime earns its keep. The rules a session runs under are text in your repository, so you can read them, diff them and revert them without asking a vendor to show you a settings screen. Read the docs covers the manifest and every field in it.