dibOS proposes a durable institutional boundaries operating system — an authority engine that governs what humans and AI agents are permitted to decide, on whose behalf, under what conditions, and with what evidence. This analysis maps the six layers it must straddle, scores the field, and identifies where the thesis is defensible and where it is exposed.
"Durable institutional boundaries operating system" is not a product description — it is a category claim. Each word commits dibOS to a different fight.
Boundaries must survive model swaps, staff turnover, re-orgs and vendor churn. This is a different promise from durable execution — Temporal, Inngest, Restate and DBOS make the workflow survive a crash; dibOS must make the mandate survive a decade.
Runtime guardrails judge an output. Institutional boundaries judge an action — who may approve a $40M transfer, whether a second signature is required, whether the agent is even the right office to act at all.
Permissions are a list. Authority is a computation: delegation chains, quorum, thresholds, separation of duties, escalation, expiry. An engine implies evaluation at request time against a live institutional model.
An OS is judged by what others build on it. That framing buys defensibility and costs distribution: it asks a buyer to adopt a platform before seeing a use case.
dibOS has no retrievable public footprint as of this analysis. The obvious domain does not resolve, no product page, documentation, pricing, funding announcement or repository surfaced, and a dedicated research pass returned nothing. Everything below is therefore a thesis-driven competitive analysis: it tests the stated positioning against the market as it actually exists, not against dibOS's shipped capabilities. Where this analysis says "dibOS scores 5," read "the thesis, if delivered, would score 5." Re-run with internal materials before using it in a fundraise or a board paper.
Buyers do not shop for "authority." They assemble it from identity, authorization, governance, guardrails and durable execution — and discover the seams later. The gap is the seam itself.
Every layer above answers a question about a principal or a request. None answers a question about the institution: what has this body delegated, to which office, within what limit, subject to what check, and what happened. That is the object dibOS proposes to make first-class. It is genuinely unowned — and that is as much a warning as an opportunity, because unowned categories are usually unowned for a reason.
Threat rating reflects commercial danger to dibOS in a competitive evaluation, not technical quality.
Microsoft has shipped the full agent-governance stack and priced it as a per-user add-on, not per agent. Four new directory object types (agent identity blueprint, blueprint principal, agent identity, agent user) give every agent a real identity with a named human sponsor accountable for its lifecycle. Access packages grant agents group memberships, OAuth scopes and directory roles through one-, two- or three-stage approval with expiry. Conditional Access evaluates agent risk at the blueprint level, so a whole class of agents inherits the same posture. Agent 365 sits above it as a control plane: registry, agents map, analytics, role-specific oversight, onboarding workflows, and least-privilege control over which users, data, tools and MCP servers an agent may touch.
Okta's Cross App Access uses an Identity Assertion JWT Authorization Grant: after the user signs in, the requesting agent obtains a short-lived, scoped token from an external authorization server and acts on the user's behalf without repeated consent — with authorization chaining across domains. Agent SSO, Agent as Principal, On-Behalf-Of and Auth for MCP extend the same model to machine-to-machine agent flows. This is the cleanest existing answer to "the agent is acting for a human, prove it."
The closest technical neighbours. Cerbos evaluates CEL conditions at request time against principal, resource and request attributes — which means you can encode a spending limit or an approval threshold as a condition. OpenFGA and SpiceDB model relationship graphs, so "this agent reports to this desk which owns this book" is expressible. Deployment is developer-friendly, self-hostable, and priced for engineers rather than boards.
Built on the CMDB and CSDM 5.0, AI Control Tower discovers and inventories AI assets — internally built, third-party and agent-driven — then layers risk and compliance management, lifecycle management, third-party AI risk and tamper-evident audit logging mapped to NIST AI RMF and EU AI Act Article 12. Sold as a package, not a per-seat list price, and deeply wired into IRM and ITSM.
Across six platforms reviewed, none is primarily a runtime-authority enforcement layer for agents. Four — Credo AI, IBM watsonx.governance, FairNow and Trustible — are inventory, policy and evidence platforms with EU AI Act documentation. Two, Holistic AI and OneTrust, claim actual runtime intervention on AI systems. Credo AI's module set is representative: AI Registry & Discovery, Unified AI Governance Platform, Governance Knowledge Graph, Governance AI Agents, modular by design.
DBOS — durable workflow orchestration out of MIT-Stanford research — makes applications and AI agents durable, fault-tolerant and scalable through annotations on ordinary code. Temporal and Inngest take similar positions, and the 2026 comparison literature is now explicitly framed around "durable execution for AI agents." The word durable is contested ground.
Some genuinely enforce in-line. Arize AX guardrails state that they correct undesirable outputs at runtime, with failed messages triggering default responses, retries or full blocking, and guards intercepting the model call. Others observe and score after the fact. The distinction between block and observe is the single most important question to ask in this layer.
This is where dibOS's language already lives. Dock Labs published a design for verifiable chains of authority for AI agents — agents that can "prove who authorized them, what they can do." Helixar Labs proposes HDP, a Human Delegation Provenance Protocol. Agent Authority Chain sells "enforceable limits on every AI agent" behind a free organisation account and domain verification. CERTEN positions itself as "the control layer of digital finance" with permissioned control for every asset on every chain. Accumulate's whitepaper and the SSRN paper on provable institutional control for tokenized finance make the same institutional-authority argument in a financial-market setting. COMPEL's governance architecture is explicitly about delegation, authority and accountability, and AgentBound publishes on verifiable behavioural governance.
Nine dimensions, weighted toward institutional expressiveness and durability of the record. dibOS is scored as its own thesis delivered, which is the most favourable reading possible — treat its row as a design target, not a market result.
| Player | Institutional semantics | Durable record | Enforce at action | Human + agent | Cross-org | Audit grade | Weighted |
|---|---|---|---|---|---|---|---|
| dibOS (thesis) | 5 | 5 | 3 | 5 | 4 | 4 | 4.01 |
| Microsoft Agent 365 + Entra | 2 | 3 | 3 | 4 | 3 | 4 | 3.09 |
| Dock / Helixar / Authority Chain | 3 | 4 | 2 | 3 | 4 | 4 | 3.03 |
| Cerbos / Permit.io / OpenFGA | 2 | 2 | 5 | 3 | 2 | 2 | 2.90 |
| ServiceNow AI Control Tower | 3 | 3 | 2 | 3 | 2 | 4 | 2.80 |
| Okta / Auth0 | 1 | 2 | 3 | 4 | 3 | 3 | 2.64 |
| Temporal / Inngest / Restate / DBOS | 1 | 5 | 2 | 2 | 1 | 2 | 2.50 |
| Arize / Galileo / Prompt Security | 1 | 2 | 4 | 2 | 1 | 2 | 2.27 |
| Credo AI / OneTrust / watsonx | 1 | 2 | 1 | 2 | 1 | 5 | 2.02 |
Institutional semantics 20% · durable record 15% · enforce at action 15% · human+agent symmetry 10% · cross-org 10% · audit grade 10% · deployment sovereignty 8% · time-to-value 7% · distribution 5%.
The field clusters between 2.0 and 3.1. Nobody is weak everywhere and nobody is strong everywhere — which is the signature of a category that has not yet been integrated. That is the opening.
dibOS's 4.01 is a thesis score. The two dimensions where the field beats it — enforcement at action time and distribution — are precisely the two that decide whether a category creator survives.
System of record for decision rights. Who delegated what, to which office, within which limit, with what evidence.
A policy decision point for institutional rules, sitting where agents call tools, APIs and MCP servers.
An OS for regulated institutions: primitives, SDK, policy runtime, and a durable authority ledger that outlives any IdP.
Lead with A, build B as table stakes, arrive at C. The authority record is the only position where the incumbents structurally cannot follow: Microsoft can ship more identity, ServiceNow can ship more register, Cerbos can ship more policy — but none of them can credibly claim to be the neutral, durable record of institutional authority across vendors and across organisations, because each is an interested party in the decision. Neutrality is the moat.
Entra Agent ID for identity, Cerbos for policy, Temporal for durability, Postgres for the audit log. A capable platform team can build a demo of this in a quarter — and that demo is dibOS's real competitor, not any single vendor on the scorecard.
The answer has to be sharp: assembly gives you permissions and durability. It does not give you authority. There is no delegation chain you can replay, no quorum arithmetic, no separation-of-duties proof, no cross-organisation boundary, and no single artefact a regulator accepts. Worse, assembly cannot prove a negative — that no unauthorised action occurred — because the evidence is scattered across four systems with four different clocks. The integration tax is not the cost of assembly; the unprovability is.
A regulated institution with a named, dated, painful obligation — an audit finding, a regulator question, a cross-border mandate — where the answer must be a durable authority record rather than a policy document. One such design partner is worth more than ten logos.
That authority must be evaluated across institutional boundaries — counterparty, correspondent, subsidiary, regulator — where no single identity provider has jurisdiction. That is the one place Microsoft, Okta and ServiceNow cannot follow.
A published primitive set — authority object, delegation edge, boundary condition, evidence record — plus an SDK that lets a third party build a governed agent without talking to dibOS. Without third-party builders, it is a product, not an OS.
It must not be priced per agent. Per-agent pricing loses to Microsoft's per-user model the moment an institution runs thousands of agents. Price on governed decisions or on institutions, not on seats.
If after two quarters no regulated institution will pay for a durable authority record independent of its identity provider, the wedge is wrong and the product should collapse into an enforcement point competing on integration. If enforcement at action time cannot be shipped within that window, the OS framing should be dropped and the company should sell as an audit and evidence layer to the compliance budget, where the incumbents are weakest on runtime.
Ten parallel research agents, October 2026. Seven returned partial results at the spend ceiling; their findings are included. Vendor claims are reported as claims, not verified capabilities.
Research was run as ten parallel browser agents, each assigned one narrow question, over October 2026. Seven agents returned partial results at the spend ceiling — their findings are included and their unfinished threads are listed in the accompanying source note. Pricing is as published by vendors on the pages cited and may change. No dibOS material was available from any public source, so dibOS is evaluated as a thesis throughout. Capability claims are vendor claims unless stated otherwise.