Every term ONTO uses, defined in one place. If a concept on the site is unfamiliar, it is explained here.
ONTO’s durable, typed store of facts about a user: identity, preferences, and owned entities. Every assertion carries provenance, confidence, a decay curve, regulation tags, and consent scopes, so you can answer "is this true right now?" instead of "what looks similar?" UPO writes are always explicit — the human, not the model, commits them.
Typed memory feature →The transient counterpart to UPO. SMO holds working context for the current session, auto-summarizes as the session grows, and promotes durable facts up into UPO when they warrant persistence. It keeps prompts small without replaying full chat logs.
Typed memory feature →ONTO routes facts extracted from natural language into one of four levels — session (transient), profile (durable identity), domain (app-scoped, multi-tenant), or tool (tool-local). Each level has its own decay, retention, and access rules. One flag (extract=True) turns a prose paragraph into a typed graph with an audit trail.
Extraction feature →ONTO’s memory model — UPO plus SMO — in which facts are stored as typed assertions with provenance and confidence rather than as raw conversation buffers or opaque vector embeddings. It answers questions about truth and ownership, not just similarity.
Typed memory feature →The record, attached to every stored assertion, of where a fact came from — which run, which source text, which extraction. Provenance is what lets you audit why the agent believes something and trace a memory back to its origin.
A first-class runtime mode that halts a run after the agent proposes tasks, before any side-effectful tool fires or any memory is written. The human reviews, edits, and approves the plan; a second run with execute scopes actually does the work. Plan Mode is a runtime invariant, not a prompting convention.
Plan Mode feature →The runtime component that gates every tool call against the consent scopes granted for that run. Tools declare the scopes they require; if a run does not carry them, Policy Guard refuses the call and returns a structured, auditable error. Enforcement is server-side and cannot be prompt-injected away.
Policy Guard feature →A named permission passed per call — for example memory:write or tools:web.fetch. The scopes you grant on a run define exactly what the agent may do on that run. No scope, no action. Scopes are the unit Policy Guard checks and the audit log records.
Policy Guard feature →ONTO’s built-in accounting of model spend, broken down per user and per tenant. It gives SaaS builders the rollups they need to attribute and bill inference cost accurately, without bolting on a separate metering system.
ONTO ships pointing at Ollama Cloud’s free open-weight models, so you can run an agent with no API-key relationship. Swap to Anthropic or OpenAI with one environment variable, or point at a local Ollama server for a fully on-prem path.
Providers on the docs →An open protocol for connecting agents to external tools and data sources. ONTO speaks MCP as both a client and a server, and integrates Claude Skills, so tools you expose through MCP are subject to the same Policy Guard consent-scope checks as native tools.
ONTO’s single implementation of the runtime, memory model, and Policy Guard, written in Rust. The Python (via PyO3), TypeScript (via napi-rs), and native Rust SDKs are thin bindings over this one core, so semantics are identical across all three languages.
Architecture →The features page shows each primitive with the code that uses it. The architecture page shows how they fit together in one request.
