AI Company Control Room

AI employees run the company while one human audits every decision, budget, token, and outcome through signed, append-only evidence—never presenting unverified work as complete.

Comment

Local context

The Living Office adapts its presentation to the configured locale and time zone. It shows local time-of-day states and retrieves weather for the corresponding office location from a verified forecast source, with caching and a safe fallback when weather data is unavailable.## Inspiration

AI agents can plan, talk, and generate impressive outputs. But when an agent says that work is complete, it is often difficult to prove which model ran, what it was authorized to do, how many tokens it used, what it cost, whether anyone disagreed, and whether the claimed result actually happened.

AI Company Control Room explores a different operating model: AI employees perform bounded company work while one human serves as auditor—not as a constant micromanager. The goal is not maximum autonomy at any cost. The goal is useful autonomy that remains observable, stoppable, and accountable.

What it does

AI Company Control Room is a private operating system for an AI-native company.

Its Living Office visualizes eight core AI employees, independent critics, meeting rooms, operational monitors, and current assignments. The office animation is only a representation: actual work status comes from persistent jobs, approvals, model executions, and signed receipts.

The company follows an operational loop:

observe → plan → assign → execute → verify → record → learn

The human auditor establishes budgets and limited authority grants. Within those boundaries, AI employees can plan work, hold meetings, propose improvements, perform approved tasks, and record results. Token usage, model routes, costs, approvals, dissent, decisions, and outcomes are stored as append-only evidence.

The system refuses to present unsigned or unverified actions as completed. If a model route is unavailable, the employee remains visibly unanswered. If a click, delivery, payment, or external action cannot be verified, it remains explicitly unverified rather than being simulated.

The working demonstration completes one evidence-backed vertical slice:

  1. The human auditor opens a direct interview with an AI employee.
  2. The question is stored and bound to a meeting turn.
  3. A local executor claims the job and calls a real model.
  4. The executor signs the result with Ed25519.
  5. The response, model route, token usage, cost, context binding, and receipt appear in the Control Room.
  6. The evidence can be inspected independently.

What makes it different

This is not simply a multi-agent chat interface.

AI Company Control Room treats accountability as part of the product architecture. SHA-256 evidence chains, append-only database rules, signed executor results, bounded retries, budget stops, independent dissent, and fail-closed model routing are designed into the operating system.

The product also separates visual storytelling from operational truth. An employee walking to a meeting room makes the system understandable, but only a verified job and receipt can mark work as complete.

What we built during OpenAI Build Week

AI Company Control Room existed before the submission period. The work presented for Build Week is the meaningful extension developed with Codex and GPT-5.6 after July 13, 2026.

The Build Week extension includes:

  • Live auditor-to-agent interviews and meeting inputs
  • An Ed25519-signed heartbeat → claim → model → result executor
  • Evidence binding for prompts, context, routes, token usage, costs, and responses
  • Role-based model routing for employees and the CEO
  • Fail-closed behavior when an approved model route is unavailable
  • Bounded retry and recovery without duplicate results
  • Complete runtime localization across nine languages: Japanese, English, French, Spanish, Portuguese, Russian, Simplified Chinese, Korean, and Arabic
  • Full right-to-left layout support for Arabic, including navigation, controls, text flow, and office presentation
  • A JSON dictionary architecture that allows languages to be updated or added without rebuilding the application
  • Display-only translation that preserves original evidence, hashes, signed records, code, and user-submitted content

How we built it

The interface is built with TypeScript, React, and Next.js-compatible tooling. Cloudflare Workers host the server-side application, Cloudflare D1 stores operational records, and R2 provides protected object storage. Drizzle ORM manages the database schema.

Database triggers enforce append-only evidence and reject invalid state transitions. SHA-256 chains protect evidence history, while Ed25519 signatures establish the boundary between the application and model executors.

Codex with GPT-5.6 implemented and reviewed the Build Week extension across the UI, services, database constraints, executor protocol, tests, documentation, localization, and deployment configuration. The human auditor made the product, governance, safety, model-routing, budget, and visual-design decisions.

Challenges we ran into

Localization was not just a matter of translating labels. The complete interface now operates in nine languages, including full right-to-left presentation for Arabic. We had to reverse layout flow where appropriate while protecting code, hashes, signed evidence, identifiers, and user-submitted content from translation. Localization therefore operates only at the display layer, leaving the underlying evidence immutable.

During Build Week, Codex and GPT-5.6 helped reduce that divergence. We removed simulated paths, reconnected the real UI/API/database/executor flow, and added tests and evidence boundaries around the working vertical slice.

Another challenge was handling unavailable models honestly. Instead of silently replacing the CEO model with a weaker route or inventing an answer, the system stops and records why it could not continue.

Localization created a similar integrity challenge: translated displays must never modify original evidence, hashes, user content, or signed records. Translation therefore operates only at the presentation layer.

Accomplishments that we are proud of

  • A real model response can travel from a human question to a signed, inspectable receipt
  • Operational status is derived from persistent evidence rather than animation
  • Model failures and missing external connections remain visible instead of being disguised
  • AI dissent and rejected decisions are preserved as company memory
  • The existing project and the Build Week extension are clearly separated through dated commits, tests, and Codex session evidence
  • A complete nine-language interface with full Arabic right-to-left support
  • Runtime language switching without rebuilding the application or modifying original evidence

What we learned

Autonomy becomes more useful when failure is explicit.

An AI company does not need a human to approve every ordinary action, but it does need clear authority, budgets, stopping conditions, dissent, and evidence. We also learned that the most valuable contribution from an AI coding agent is not always generating more code. Sometimes it is finding divergence, removing false completeness, and forcing the product to converge on one real path.

What's next

Next, we will package a dedicated judge environment with synthetic company data, a test account, and a preconfigured model route. We will complete the private 24-hour executor connection, add further languages through the runtime dictionary system, and connect external business actions only when they can return signed receipts.

The long-term goal is an AI-native company that can operate globally while remaining understandable and controllable by one human auditor.

Built With

Share this project:

Updates