Models change. The Workspace stays. More client work. Same team.

We call it an AI worker because its purpose is to help you work and carry out real work in the systems your business uses. Its persistent Workspace holds the context, files and approved access that work needs.

See it in real agency work Get the one-pager

A company-controlled execution environment around a durable client Workspace.

We call it an AI worker. On purpose.

The word “worker” means something: there is work to do, context to understand and a result to reach. Agent describes the ability to act. Worker defines the purpose we give that ability.

The AI worker we believe in exists to help you work and carry out real work online: read the relevant information, update the CRM, work across websites and business systems, and use an API when the task calls for it — within its approved access and permissions.

The work may cross several systems. The objective stays the same. The worker should keep the context, move the task forward and know when a decision needs you.

We measure it by the work completed.

For example: read a meeting summary, update the right CRM record and prepare the follow-up for your approval.

The Workspace is the durable operating home.

Client identity, Context, Skills, Routines and work records belong together. Keep that operating home around the model you choose.

A company-controlled Mac today

Local files, installed apps, browser work and configured networks give the worker somewhere to execute. The company supplies the Mac and model access.

Choose the environment for the work

Evaluate access, persistence, privacy and cost. Local and remote environments have different strengths; location alone does not determine who controls the operating setup.

Compare local and remote environments

Use the model that makes sense for the work. Keep the Workspace around it.

What changes when the tools share a working environment?
From separate tools to an AI worker with a Workspace.
Operating model Separate toolsA worker with a Workspace
01 One tool for copy, another for images, another for videoA capable model that understands the objective and plans the work
02 One tool for campaign optimisation, one for reportsApproved access to the business systems that client uses
03 A separate interface for every marketing channelA workspace that knows which client it belongs to
04 Context and history scattered across all of themContext and reviewed learning that stay with the company
05 A separate subscription and setup for each new needA durable client Workspace around supported execution
06 A person acting as the integration layer between themHumans setting the goals and approving the sensitive actions

Six parts. One worker.

The model reasons. A Workspace gives it somewhere to work, something to remember and permission to act.

The operating home

Client identity, files, approved accounts and work records stay together.

The reasoning

Reason, plan, write and analyse with the model suited to the work.

The working environment

Supported agent environments turn an objective into tool use and execution.

The execution surfaces

APIs, browser work and files connect the task to business systems within supported scope.

The working knowledge

Client knowledge and human-reviewed methods stay versioned and separate.

The operating infrastructure

Workspaces bring approved access, supported execution and reviewed methods together.

Runtime and provider names identify products; they imply no partnership or endorsement.

One objective, one client, one loop that closes.

Follow an approved request, a refused wrong-client request and a model change. This conceptual loop shows the boundaries around the work.

One AI worker, one loop, on the company's computer A person sets an objective. It enters the company's computer — a dedicated machine in the office — where a replaceable runtime plans the work, Outloop decides whether the request is allowed for that client, account and action, and the approved work reaches a client system such as Google Ads, Meta, Drive or GA4. The result is written to a redacted audit, a reviewed lesson is captured, and the loop returns to the runtime. A request naming the wrong client is denied at the access decision and still audited. The runtime can be swapped for another approved model while the workplace, the audit and the learning stay in place. 01 The objective set by a person 02 THE COMPANY'S COMPUTER In the office · the persistent workplace 03 Runtime / model replaceable Claude Code Claude Cowork Codex An approved open model approved open model · vision 04 Outloop decides ALLOWED RESOURCE_ID_NOT_ALLOWED the right client the right account the permitted action 06 Audited result client-bound work 07 Reviewed learning a person approves it the loop closes here 05 Client systems Google Ads Meta Drive GA4 Business systems one client's approved account at a time A dedicated computer in the office. One client at a time. Approved work completed for the right client — and written to the audit. Wrong client. Denied before any backend call — and the denial is audited too. The model changed. The workplace, the audit and the learning stayed. One AI worker, one loop, on the company's computer A person sets an objective. Inside the company's computer — a dedicated machine in the office — a replaceable runtime plans the work, Outloop decides whether it is allowed for that client, account and action, the approved work reaches a client system, the result is audited and a reviewed lesson is captured before the loop returns to the runtime. A wrong-client request is denied at the access decision and still audited. 01 The objective set by a person 02 THE COMPANY'S COMPUTER in the office 03 Runtime / model replaceable Claude Code Claude Cowork Codex An approved open model 04 Outloop decides ALLOWED RESOURCE_ID_NOT_ALLOWED right client · right account · permitted action 06 Audited result client-bound work 07 Reviewed learning a person approves the loop closes here Google Ads Meta Drive + GA4 · other approved business systems A dedicated computer in the office. One client at a time. Approved work completed for the right client — and audited. Wrong client. Denied before any backend call — denial audited too. The model changed. The workplace, audit and learning stayed.

Illustrative model, not a recording of a customer account. Runtime names are shown to identify approved agent environments — no partnership or endorsement is implied.

  1. The objective — a person defines the work, the boundaries, and what needs approval.
  2. The execution environment — a company-controlled Mac today. The files, context, tools and operating knowledge stay here.
  3. The runtime and model — replaceable. Claude Code, Claude Cowork or Codex today; an approved open model is a stated vision, not a shipped capability.
  4. The access decision — Outloop resolves the right client, the right account or resource, and the permitted action, without exposing the raw credential.
  5. The client systems — approved work reaches Google Ads, Meta, Drive, GA4 or another approved business system.
  6. The audited result — allowed and denied attempts are both written to a redacted local audit.
  7. Reviewed learning — a lesson becomes a context revision only after a person approves it, and it can be rolled back.
  8. A request naming the wrong client is denied at the access decision with RESOURCE_ID_NOT_ALLOWED, before any backend call, and the denial is audited.
  9. The model can be swapped for another approved runtime while the workplace, the audit and the reviewed learning stay in place.

You set the boundaries.
The work moves inside them.

Give the worker a task. Keep each client’s accounts, context and decisions in the right Workspace.

A person sets the direction

Define the task and the boundaries before the worker starts.

Use the approved account

The Workspace identifies the intended client, account and resources.

Work inside those boundaries

The worker uses supported APIs, browser work and files.

Keep the decision with you

Sensitive work waits for human approval. Supported allow and refusal events leave a record.

What Outloop brings to the Workspace

Separate client Workspaces, approved accounts and resources, supported runtimes, reviewed working methods, Context, Skills, Routines and work history.

Outloop provides the operating environment around AI runtimes. It is not an AI model, a password vault or a collection of connectors. Reusing a method does not transfer private client state.

Read the security model or follow a denied multi-client request.

The method is the asset.

Turn work that succeeds into a reviewed Skill, Routine or playbook. Start the next client from that method, with their own accounts and Context.

Reviewed method. Separate clients. Concept illustration.

Share the method.

Keep the client’s data private.

A person decides what becomes reusable. Private information, performance figures, creative assets and execution stay inside each client’s Workspace.

What is proven, and what still needs measurement

Client Context and reviewed Learning are live. Reuse of client-neutral implementation is qualitatively proven. Setup time, magnitude of gains and repeatability at scale are not yet quantified. Private state does not move automatically.

How the human review lifecycle works

Change the runtime.
Keep the work around it.

Choose capability that fits the task. Evaluate cost alongside quality, tools and operational requirements.

Run with Claude Code

Use a ready, supported runtime for the work.

Continue with Codex

Current Routine continuity preserves instructions, schedule and history between ready Claude Code and Codex.

What carries over today?

Current Routine continuity covers instructions, schedule and history between ready Claude Code and Codex. It does not promise arbitrary session or machine migration.

Smaller, open and local models may expand the choice over time. Outloop does not automatically route by cost, guarantee savings or promise universal local-model parity.

A computer belongs
to the physical world.

A company machine can connect to a phone, capture equipment, storage and the company network. The environment extends beyond a browser tab.

Calls and messages

A company phone, number and SIM can belong to the role.

Cameras and microphones

Connect approved production equipment to the company machine.

The company network

Work within the networks and resources the company configures.

Files and local equipment

A machine can connect to approved storage and studio equipment.

Connected equipment is possible today.

Outloop does not supply, provision or natively manage these devices. Physical connection does not grant an AI worker permission to operate them. Remote environments can also support device workflows.

The longer-term vision

Broader governed autonomy over connected equipment, deeper device operation and teams of specialised AI workers. These remain a direction, under permissions, audit and human control.

Ambition needs an honest line.

What runs today, how to set it up, and what we still have to prove.

Shipped and verified

today

  • Client Workspaces with approved Context and resource binding

    proven

  • Recorded allowed and refused Google Ads / Meta requests

    proven

  • Reviewed Learning, Skills and Routines within supported scope

    live

  • Routine instructions, schedule and history retained across ready Claude Code / Codex switches

    Stable 1.45.0

  • Reuse of client-neutral implementation work

    qualitatively proven

    Magnitude and external implementer repeatability are not yet quantified at scale.

The current operating model

how to set it up

  • A company-controlled Apple Silicon Mac

    current model

    The current execution environment, with configured files, apps and network access.

  • Configure and validate every client separately

    operating practice

    Reuse the method; keep private Context, accounts, resources and history separate.

  • Choose the supported runtime for the workload

    operator choice

    Balance capability, cost and operational requirements; Outloop does not automatically choose the cheapest model.

These are operating choices, not a claim of universal machine or runtime support.

Where we think this goes

not shipped

  • Broader economic runtime optionality

    direction

    Smaller, open and local models may become suitable for more routine work. This is not universal local-model parity or guaranteed savings.

  • Broader Workspace portability

    direction

    Complete cross-provider and cross-machine migration is not a shipped promise. Current Routine continuity has a specific supported scope.

  • More resilient work across execution surfaces

    hypothesis

    An operating principle to prove workflow by workflow; never a promise that an AI worker cannot get stuck.

Nothing in this column is sold, priced, or promised on a date. It is written down so you can hold us to the difference.

See the work behind the idea.

A prediction is worth very little on its own. These are the workflows where the argument stops being theoretical.

Agents across many clients

What running agents across a book of clients actually looks like, and where the access breaks first.

Read it

The system, end to end

What Outloop actually is today — the company-controlled Mac, approved access, files, audit and reviewed learning.

Read it

A wrong-client request, denied

Recorded Google Ads and Meta proof: configured approved requests succeed and out-of-scope requests are refused.

Read it

Sandboxed agent workflows

Why a sandboxed agent stops mid-workflow, and what changes when access is granted properly.

Read it

Take the whole argument with you.

The original vision, on one A4 page. Take it to a partner meeting or a leadership conversation; this page carries the latest scope and product details.

Download the AI Agency Manifesto

PDF · A4 · no form

Preview of the Outloop AI Agency Manifesto one-pager
Adam Argaman, Founder and CEO of Outloop

We ran an agency. The agent was never the problem.

Every workflow we built worked beautifully in a demo and then stalled in the same place: the moment it needed access to a real client's systems. Someone had to stop, find a key, paste it somewhere, and remember which account belonged to which client.

We were not missing a smarter model. We were missing the layer that decides what an agent is allowed to do, for whom — so the work can continue without a person handing over credentials, and without the wrong client's account ever being touched.

That layer is what we build. The rest of this page is where we think it leads.

Adam Argaman

Founder & CEO, Outloop

One person will manage one AI worker — and later, a team of them.

That is the direction: a team of workers with clear objectives, separate client Workspaces and human review where it matters. The company keeps the operating knowledge.

The model
thinks.
The computer
runs the work.
The API
performs the action.
Outloop
routes, separates and controls access.

Models change. The Workspace stays.

Start 14-day trial Request a Workflow Review

Live product with setup guides and product support · Keys stay local · Cancel anytime

A few practical questions.