Agent NAS: network-attached storage for AI agents. Where agents work, and you stay in control.

At a glance #

Category

Network-attached storage for AI agents, also called agent-native storage.

Core idea

The unit of access is the run, not the account: a run works on a branch, reaches data through a lease and leaves a record.

Four promises

Bounded, recoverable, accountable and inspectable.

Core nouns

Tree, Commit, Principal, Run, Lease and Record.

Concepts

Nine named concepts in three clusters: Work, Authority and Knowledge.

Interfaces

Data plane: mount, Git, S3, WebDAV. Control plane: MCP, HTTP, CLI.

Specification

Draft v0.2 with conformance levels from L0 Files to L4 Sync, each with executable acceptance tests.

Status

Concept and specification stage, no reference implementation yet. L0 and L1 can be built today from existing parts.

License

Content under CC BY 4.0.

Why now #

Four things have already happened in the past year.

• Agents work in files. AGENTS.md, Agent Skills, Git-backed memory (Letta Context Repositories) and dynamic context discovery, which writes long output to files, have made files the working medium of agents.
• Mistakes are fast and expensive. In April 2026 a coding agent used an over-broad token it found in an unrelated file and deleted a company’s production database and the backups on the same volume in 9 seconds.
• People cannot review every step. Anthropic reports that users approve 93% to 97% of permission prompts; in its controlled experiment, people caught only 13.6% of planted dangerous commands.
• Memory became an attack surface. Several 2026 studies show that a malicious instruction written into persistent memory survives across sessions, and that defending only at input or retrieval helps little.

Storage vendors have moved too: QNAP QuAgent, Synology DSM Agent and TrueNAS MCP all let an agent manage the box. But as far as we can see, there is still no self-hosted, open, verifiable contract for how other agents work safely on the data inside it. See how Agent NAS compares with existing approaches.

Four promises #

Nine concepts, three questions #

Agent NAS proposes nine named concepts. Each has its own page: a definition you can quote, a mechanism, a way to start small, an interface sketch, what the specification asks of it, and its honest limits.

Four layers, six nouns #

The Store layer uses mature storage as it is. Every layer above it can be rebuilt from it, and the core is just six nouns: Tree, Commit, Principal, Run, Lease and Record. We do not invent a storage engine; the innovation is in the contract.

Read the architecture.

The journey of a run #

1. Request a lease. The orchestrator of the research agent Cleo requests a Capability Lease for this run: read /shared/launch, propose changes, valid for four hours. The owner’s pre-set policy envelope approves it automatically.
2. Start work. The NAS creates the run and its branch cleo/run_91ab; the sandbox mounts the branch as an ordinary directory. Cleo reads AGENTS.md and its reviewed memory from its Agent Home.
3. Read within a budget. It reads a long report with Budgeted Reads: a 400-token outline first, then specific line ranges as needed. Every read is added to the run’s read manifest.
4. Work on a branch. Changes land on an Agent Branch. The shared main does not change at all for now.
5. Meet a gate. Cleo has read a web page, so Trust Labels give its session external taint. When it proposes a merge into main, policy requires a Human Gate: the owner sees the real diff computed by the NAS and the untrusted source on a phone, and approves.
6. Leave a record. The merge creates a commit with provenance. What was read, what was written and who approved what all go into the Flight Recorder, hash-chained.
7. Settle memory. Cleo notes down a few new facts. Because this session read external content, these Agent Memory notes go into quarantine first: they can be recalled but will not autoload until a person reviews them.
8. Forget. Weeks later, a customer asks to be forgotten. Cascade Forget deletes the related summaries and indexes along lineage and issues a report that states what it could not cover.

It speaks what agents already speak #

No new SDK is needed to start. Any agent that can read and write files, use Git or S3, or call MCP tools can use Agent NAS. The session below only illustrates the planned command line.

$ nas lease create --role cleo --paths "/shared/launch/**" --actions read,write,propose --ttl 4h
lease lse_7Qk3 · run run_91ab · branch cleo/run_91ab · expires 16:00
$ nas mount --lease lse_7Qk3 ~/work       # plain files, on a branch
$ ./draft-release-notes.sh                # the agent works with ordinary tools
$ nas propose --into main
gate gt_2Mx4 waiting for approval: merge cleo/run_91ab into main (4 files)
$ nas gate approve gt_2Mx4                # the owner, from another terminal or a phone
merged · commit 91ce3a7 · record 18211

See all interfaces.

What we are betting on #

A design that hopes to hold up for years should say what it bets on and what happens if it bets wrong.

• Agents will keep using file systems and Git as their main working medium. If not, Agent Home degrades to an export format and the other concepts still stand.
• “A run” remains the natural unit of authorization and accountability. If long-lived autonomous processes appear, leases become rolling renewals with budgets.
• Prompt injection will not be eradicated at the model layer in the foreseeable future. If it is, Trust Labels become a cheap layer of defence in depth.
• Human attention stays scarce. If full automation becomes reliable enough, a Human Gate gives way to pre-authorizing policy and the audit trail stays.

All seven bets are in the design principles.

This site is readable by agents too #

Every page has a Markdown twin, the site publishes llms.txt and it runs a small read-only MCP server. Try it in a terminal:

curl -H "Accept: text/markdown" https://agentnas.com/what-is-agent-nas/
curl https://agentnas.com/llms.txt
curl -X POST https://agentnas.com/api/search \
  -H "content-type: application/json" \
  -d '{"query": "capability lease", "limit": 5}'

Add the documentation server to an MCP client:

{
  "mcpServers": {
    "agentnas-docs": { "url": "https://agentnas.com/mcp" }
  }
}

The questions people ask first #

All questions.

Where things stand #

• Draft specification Conformance levels and executable acceptance tests.
• Roadmap Now, next, later, and what we will not do.
• About this project License, how to cite, and how to take part.