How ADC works

The agent plans, ADC routes, the device executes

An agent loop and an execution environment are separate parts. ADC connects them through device discovery, authorization and tool routing; it does not introduce another model loop. Permissions and task receipts make this connection manageable.

Three parts

Agent interface: Plugins, the Skill, MCP, CLI and SDK. They all submit the same typed invocation, for example file.read with a path.
ADC service: Authenticates the caller, evaluates permissions and approvals, queues work for the device and keeps the audit record. It never runs your tools.
Device connector: Holds an outbound connection, advertises the tools it offers, re-checks every path locally, runs the tool and stores a receipt before reporting back.

A cloud runtime can use local execution environments

The runtime's own shell acts on its own machine. ADC adds tools targeted at other Nodes so the agent can use their files, programs or hardware. The route must return an observable result; registering a device without usable tools does not create the ability to operate it.

From cloud reasoning to device actions

What decides whether a call is allowed

A call runs only if every layer allows it. No layer can widen another, and changes apply to new calls immediately.

01Device scope
What the device owner exposed with adc-node.
02Device policy
Console settings for that device: usable folders, read-only folders, execution on or off.
03Agent access
The devices, folders and tools granted to this agent.
04Approval
Whether writes, commands or every call wait for a person.

The life of a call

01requested
The agent submits a call with its credential.
02authorized
ADC resolves the device and checks every layer.
03approval
If required, the call waits for you without holding the device.
04leased
The device claims the work and renews a short lease while it runs.
05running
The connector checks the path again and runs the tool.
06done
The result and receipt return; Activity records the outcome.

Permissions are checked again when the device claims work and on every lease renewal, so revoking access stops running work too.

Retries and unknown outcomes

Calls that change something need an idempotency key, and the device writes a durable receipt before reporting. Retrying with the same key returns the original result instead of running twice.

If a call may have run but no receipt can be proven, it ends as unknown_outcome. ADC never retries it automatically; check the target first.

What is stored where

ADC service

Accounts, exposed folder names, Agent access, call arguments, returned results and receipts.

Your device

The device private key, local MCP credentials and every file that was not explicitly requested.

Projects are optional groups of folders across devices. They are not a security boundary.