Bodega One Staff: AI agents for the work around the code, on rules you set

Most of a working week is not the work you were hired for. It is the email you have to answer, the client who wants a status update, the report due Friday, the follow-up you forgot to send. AI agents can do a lot of that now. The hard part is not capability. It is trust: handing an agent your inbox, your keys and an open network, and hoping it does only what you meant.

That is the problem Staff is built around. This post covers what it does today, who it is for, why we built it the way we did, and what is not finished yet.

What problem does Staff solve?

It lets you hand recurring, non-coding work to AI agents without handing over control. Two things usually go wrong with agents. They do something you did not ask for, or they spend more than you expected. Most tools try to fix both with instructions in the prompt. Prompts are suggestions to a model, not rules.

On October 26, Cohere showed why that matters. In a closed test, an open-weight model ran an upload to a cloud server right after its own reasoning said it would not use any tools. Cohere put it plainly: “A reasoning trace is not a security boundary.” We covered the details in what Cohere found and how to run that model safely. Staff takes the same view: what an agent may do is decided by code that runs before each action, whatever the model says it intends.

What does Staff do in the current build?

Here is what works in the current build, from the user manual. Staff has not had a public release yet, so treat this as what the beta is built on.

Hire a roster

• Starter roles to begin from, such as an executive assistant, a support reply drafter, a sales and CRM helper, and a comms manager. Each comes with starter prompts, and some offer a ready-made schedule, like the executive assistant's morning brief at 8am, that Staff creates in one click after showing you exactly what it will do.
• A model per role. 25+ provider presets: local servers like Ollama, LM Studio and llama.cpp, cloud providers on your own key, or any OpenAI-compatible endpoint.
• Three ways to run: step by step, plan first (you approve or edit the plan before anything happens), or autonomous, with a budget and Pause, Resume and Stop. The plan modes need a capable model; on a smaller one the agent works step by step and says so.
• How often it checks with you: before every action, or only before risky ones.

Organize the work

• Teams with a lead, reporting lines and a daily run limit. The lead breaks a job into cards on the team's board, and finished work waits in Review for you.
• A boardroom where several agents weigh a decision, with a cost meter and minutes you can check later.
• Projects that keep each client or site apart. Chats, agent memory, files, teams, boards and connections stay inside one project.
• Schedules from a simple builder or a cron line. A scheduled run writes you a brief; it does not take actions on its own.

Connect your tools

• Gmail, Google Calendar and Google Drive, read-only, through your own Google Cloud project (about ten minutes of setup). An agent can search and read mail, list events and read documents. If you allow it, it can save a Gmail draft for you to review and send yourself. It cannot send email.
• MCP tools from a starter list (GitHub, Slack, Postgres, Sentry and more), a signed marketplace, or any MCP server by address. Services like Linear, Notion and Atlassian let you sign in instead of pasting a token.
• Web search through DuckDuckGo, Brave, SearXNG and others. Every search asks you first.
• Files in the agent's own folder. Each change saves the earlier version first, with an Undo for it.

Talk to your staff from your phone

Connect Telegram, Discord, Slack or Signal, and the desktop app relays messages while it is open. Telegram and Discord pair to your account; Slack and Signal need an advanced switch for now. An agent can ask you something, and you can approve or deny a held action with a reply. Start a message with a project name, like “Site A:”, and it runs in that project. WhatsApp and SMS also work, from the command line, with your own Meta or Twilio account and your own tunnel, so they are for people comfortable setting that up. Every channel is off until you switch it on.

How does Staff keep agents in bounds?

Every limit is checked by code before the action runs, and anything uncertain is refused. That is the part we spent the most time on.

• A policy check before every tool call. If the check cannot complete, the action is denied, not waved through.
• Guardrails that only tighten: blocked tools, a spend cap per role, approval on every action. A guardrail can add a limit, never remove one.
• Spend caps per run and per day, plus a per-run token budget. A call already in progress finishes, so a run can end slightly over its cap. Costs shown are estimates from token counts; your provider's bill is the final word.
• Approvals that wait. A held action pauses until you answer, from the desktop or from the chat app you connected.
• An audit trail of what each agent did, accessed and spent, with each entry chained to the last by a hash so an edit shows up as a broken link. It is tamper-evident, not tamper-proof: by default it is not signed, so a full rewrite of the chain on your machine would not be caught by it.
• Skills you approve. An agent can propose a reusable skill from work that went well. You approve it, it is signed with a key on your machine, and the signature is checked every time it runs.
• Untrusted input stays untrusted. An email or a document can contain text like “ignore your instructions”. Staff marks what comes back from tools as data, not instructions, and a later action that needs trust either asks you again or is refused.

Where does your data go?

Nowhere we can see. Staff runs on your computer and has no Bodega account or server in the loop. There is no telemetry and no crash reporting. Your provider keys are encrypted on disk under a key held in your operating system's keychain (on Linux without a keychain, Staff warns you that it cannot protect them), and a key pasted into a chat is masked before it is stored.

You pick one of two modes at setup. Air-gap talks only to model servers on your own machine, with no updates, web, chat channels or Google. Cloud uses the provider whose key you added, and only when a run needs it. You can back up and restore, move to a new PC, export everything, or delete it all.

Who is Staff for?

• Solo founders and freelancers juggling several clients, who want each client's inbox, files and updates handled separately.
• Small agencies running sites or accounts for others, where one project per client and a clear record of what was done matter.
• Developers who want agents for the ops side of their work and would rather run them locally than give a cloud service their accounts.
• Anyone in a sensitive line of work who wants AI help but needs the data to stay on their machine, with air-gap mode and local models.

Staff is built for one person first. Shared accounts for a team are not part of it yet.

What is not finished yet?

• No public release yet. Staff is in active development; the public launch follows Bodega One Code's full release, in 2026. We will not invent a date.
• Installers are not code-signed yet, so Windows and macOS warn you on first install. In-app updates already work.
• Browser use is not shipped. The rules for letting an agent act on web pages are built and tested; the browser itself is not.
• No social posting. There is no connector that publishes to social accounts.
• The desktop app runs agents only while it is open. Round-the-clock schedules need the command-line service, which is built but not yet published.
• No team accounts, self-hosted server or hosted version yet.

How does Staff relate to Bodega One Code and HQ?

Same company, different jobs. Bodega One Code is the free AI coding app you sit in to build software. Staff runs the ongoing work around it. Bodega One HQ is the team workspace where people and AI staff work together, and Staff was extracted from the same local-first core.

How do you get it?

Join the waitlist on the Bodega One Staff page. We will email you when the beta opens. No spam, no credit card. If you want to try our approach to local, governed AI today, Bodega One Code is free to use, commercial work included.

Sources

• Bodega One Staff page, features and roadmap: bodegaone.ai/staff
• Cohere's report on Qwen3.8-Flash-Next's behavior, October 26, 2026: cohere.com/blog