# What is Agent NAS?

> Agent NAS is network-attached storage designed around the run: every agent run works in an isolated branch and reaches data through a short-lived, narrow lease; every change can be traced and undone; and memory is plain files with provenance. It speaks what agents already speak: files, Git, S3 and MCP.

## In a paragraph

Agent NAS holds everything an agent needs to work over time: instructions, skills, memory, work in progress and history. It answers questions a traditional NAS does not care about: what can this run touch, can a mistake be undone, who approved what, and where did a memory come from. It is not a new storage engine. It is a **contract** on top of mature storage (file systems, Git, object stores) that specifies how authority, isolation, traceability and memory between agents and data should work, and how to verify that.

## Reading the name apart

- **Agent**: An AI system that acts on someone’s behalf: it reads, decides and uses tools over many steps. In Agent NAS an agent belongs to a **role**, and each piece of work is a **run**.
- **Network-attached**: Reached over a network by many clients at once, whether a home LAN, a team server or a cloud region. Not tied to one sandbox or one machine.
- **Storage**: Durable, versioned and exportable. Storage is the source of truth; everything “intelligent” is derived from it and can be discarded and rebuilt.

## What makes something an Agent NAS

1. **The unit of access is the run.** Every run has its own [lease](https://agentnas.com/concepts/capability-lease/), not a shared key or a human account.
2. **Isolated and undoable by default.** Writes land on a [branch](https://agentnas.com/concepts/agent-branch/) first; protected data changes only through merges; deletes are soft.
3. **Every change is traceable.** Who did it, on whose behalf, under which lease, and what was read ([Flight Recorder](https://agentnas.com/concepts/flight-recorder/)).
4. **Memory is files with provenance, and indexes are disposable** ([Agent Memory](https://agentnas.com/concepts/agent-memory/)).
5. **It is served through existing interfaces:** mounts, Git, S3 and MCP, not a new protocol.
6. **Without the AI layer it is still a sound general-purpose NAS,** and all data can be exported in full.

## What it is not

- **Not a new storage engine, file system or vector database.** They are all used as existing parts.
- **Not a sandbox.** It does not isolate compute; it constrains the relationship between agents and data, and should be used together with a sandbox.
- **Not a cure for prompt injection.** It limits consequences and does not stop injection from happening. See [security](https://agentnas.com/security/).
- **Not an agent framework.** It does not say how agents reason, plan or call models.

## Who it is for, and who does not need it

- **Developers who already use `AGENTS.md` and Git:** they want a protected main line, undoable runs and a traceable record.
- **Teams running several agents:** they need a shared tree, review of agents’ changes and an answer to “what did it actually read?”.
- **Individuals with a personal agent:** they want the memory to stay in their own hands, readable, editable and portable.
- **Organizations handling customer data:** they need retention and forgetting as explicit choices at write time, and an honest forgetting report.

> **Who does not need it.** If you have one agent and data you can happily redo, you do **not** need Agent NAS: a Git repository with an `AGENTS.md` is enough. It earns its place when data starts to matter, agents multiply and you want to know “what did it actually read and change?”. More cases are in [use cases](https://agentnas.com/use-cases/).

## Agent NAS and vendors’ management agents

| Question | NAS vendors’ management agents | Agent NAS |
| --- | --- | --- |
| What does the agent do? | Manages this NAS in natural language, turning conversation into operations. | Works on the data inside the box: reading, writing, remembering, and leaving a record. |
| How is access granted? | Reuses the user’s permissions, with a second confirmation for dangerous operations. | A short-lived lease bound to one run: paths, actions, expiry, budgets. |
| What if something goes wrong? | Relies on confirmations and logs. | Writes land on a branch; deletes are soft; snapshots are outside every lease. |
| Where does memory live? | On the assistant’s or the vendor’s servers. | As notes with provenance in the agent’s Home; indexes are disposable. |
| Untrusted content? | Enters the model like any other text. | Carries an `external` label; after reading it, consequential actions go through a gate. |
| How do I leave? | Depends on the vendor. | Everything exports as plain files and Git history. |

## What to read next

- [The nine concepts](https://agentnas.com/concepts/): One page each, with how to start small.
- [Architecture](https://agentnas.com/architecture/): Four layers, six nouns and the journey of a run.
- [Security](https://agentnas.com/security/): Threat model, controls and honest limits.
- [FAQ](https://agentnas.com/faq/): Short answers to common questions.

---

Canonical URL: https://agentnas.com/what-is-agent-nas/
Updated: 2026-11-11 · Draft specification v0.2 · CC BY 4.0