--- title: "Agent factories will leave IT for machines nobody runs" url: "https://kyberlinux.com/blog/agent-factories-on-machines-nobody-runs" description: "Agent loops with people at the decision points are coming to bookkeeping and purchasing. They will land on machines with no admin, so the system must supply the conditions." --- # Agent factories will leave IT for machines nobody runs November 2, 2026·4 min read·Editorial team A rounded green mini computer beside a green tray holding a stack of blank paper, joined by a cable to a small black module with one lit status light Agent factories will leave the IT department, and when they do, they will land on machines that nobody administers. Software teams already run work through a loop: a ticket comes in, agents carry it through one stage after another, and people approve at a few decision points. The same model is coming to bookkeeping, purchasing and customer service, because the same arithmetic of cost, time and control applies there. There is one difference. In IT, the loop sits on a server someone looks after. In a small office, it sits on a mini PC under the owner’s desk. ## Why developers got there first Not because they are smarter than bookkeepers. Their work has long met three conditions without which no agent loop will run: 1. **The input is written down.** A ticket, a change description, a version history. An agent has something to read. 2. **The output can be checked.** Tests pass or they do not. The program starts or it does not. 3. **Every change leaves a trace.** Who, what, when and why, recoverable a year later. In a bookkeeping office, the input is a scanned invoice in someone’s inbox, the output is checked by the person who has known the client for ten years, and the trace of a change is that person’s memory. An agent factory in that office will not start with buying an agent. It will start with writing the work down so that someone new, a person or an agent, could pick it up. That is work for the people in the office. But two of the three conditions are also about the ground the factory runs on, and that is where the operating system comes in. ## What changes when the loop leaves the server room In an IT department, an agent runs on a machine somebody built, patches and watches. It has its own account, a configured network and logs collected in one place. None of that was designed for agents, but it exists. In a five-person office, none of it exists. The agent runs on the owner’s account because that was easiest. It can see the owner’s mail, the bank session in the browser and the contracts folder. The network is open to the whole world. Nobody reads the logs, and the ones that exist rotate away after a week. A system update arrives overnight and nobody knows whether the agent will come back up after it. A loop that is a process in IT becomes a pile of scripts on someone’s account in that office. The condition “every change leaves a trace” stops being true exactly where it matters most: money and contracts. ## Where KyberLinux plugs in KyberLinux is designed as ground for agents, not as a general-purpose system that agents are bolted onto. In an agent factory it is responsible for three things an office without an admin will not do by itself. **Every agent in its own cell.** The invoice agent gets a [KyberCell](https://kyberlinux.com/blog/how-kyberlinux-keeps-a-swarm-in-cells): it sees the invoices folder, writes to one working directory and connects to one accounting system. It cannot see the owner’s mail or the bank. If it needs more, it asks, and the decision goes back to a person. **A record the agent cannot change.** Every command, touched file and connection goes into a [log an agent can read and a person can understand](https://kyberlinux.com/blog/logs-an-agent-can-read-and-a-person-can-understand). The agent cannot edit it. That is the factory’s third condition, supplied by the system rather than by people’s discipline. **A known machine state.** The system image is [immutable and verified](https://kyberlinux.com/blog/immutable-verified-boring), and an update is a whole new image that rolls back if the machine does not come up. A loop that processed forty invoices on Monday runs on the same ground on Tuesday, not on a system that changed halfway overnight. What KyberLinux will not do: write your process down for you, or tell you which invoice looks wrong. That is work for people and agents. The system gives them a floor on which that work leaves a trace. And to be straight about it: KyberLinux is pre-launch, and none of this can be installed today. ## Where automation does harm **A factory without people.** An agent that posts a quarter-end correction by itself, or sends a payment demand to a client in a dispute, does not save work. It creates it. The agent reads, prepares and proposes. A person decides, signs and answers for it. **Permissions set to “everything for now”.** The quickest way to a working demo is to give the agent the owner’s account. In a factory, that means one malicious instruction hidden in an invoice can reach everything. A narrower cell costs a few more questions. A wide one costs an incident. **A record that turns into a ranking of people.** Once work runs through a loop, you can see who corrected the agent and how often. Those numbers are for improving the loop, not for comparing staff. Use them the other way and the best people leave first. ## How you know it is working Vanity metric Outcome metric number of agents running in the office how many times a person touched one task before it closed invoices “processed by SI” share of tasks needing no correction after a person approved them “the agent has access to every system” how many permissions the widest cell holds, and whether anyone can list them from memory lines in the logs whether you can tell, within fifteen minutes, which agent changed an entry and on whose request ## Where to start on Monday Pick one task that comes back every week and has a clear input and output: reconciling a bank statement, a summary of orders, a reply to a routine enquiry. Write it down on one page: what comes in, what has to come out, how you know it is right, and who approves. Then ask two questions about the machine an agent would do it on. Whose account would it run as? Where would the record of what it did end up, and could it change that record? There is more about [KyberLinux](https://kyberlinux.com/) on the home page. That leaves a choice. You can let an agent loop into the office on the owner’s account and hope nothing happens. Or you can put down the ground first, where every agent has its own cell and every step its own trace, and only then invite agents to work. - agent factory - agents - KyberCell - logs - small business ## Keep reading - [The Kyber I/O scheduler in Linux: what it does and when to use it](https://kyberlinux.com/blog/the-kyber-io-scheduler-in-linux) - [A reference list without Debian: choosing a base for SI](https://kyberlinux.com/blog/a-reference-list-without-debian)