Act, under control beta
The computer-use agent you are allowed to deploy.
QuoxBox turns an always-on Mac into a governed worker. Quox drives it through a policy gateway, so every action passes default-deny governance before it touches the machine. Every step is recorded on a tamper-evident chain.
Refusals included.
- 01 · ask
- 02 · policy gate
- 03 · human approves
- 04 · act
- 05 · verify
- 06 · evidence chain
In plain words
What it is, where it lives, when to reach for it
- What is it
- An agent that works an always-on Mac for you, with every action checked by a policy gateway first. Beta.
- Where do I use it
- In your terminal through the
quox quoxboxcommands, against a Mac you set up as the box. - When would I use it
- When a job needs a real computer working unattended, but you still want to approve the risky steps.
- How do I use it
- Run
quox quoxbox run <workflow>to start a task; risky steps wait for your approval in the inbox.
The governed loop
Six steps, on the record.
denied → recorded on the chain as evidence. A refusal is not a dead end.
The always-on worker
A Mac in the corner, on the record.
Put a Mac mini in the corner and let Quox operate it: click, type, read the screen, run the app. Nothing happens off the record.
- Quox drives the machine through the policy gateway, never directly.
- Every click, keystroke and screen read lands on the evidence chain.
- What the gateway refuses is recorded too. Refusals included.
Why a Mac
The work that has no API.
A cloud agent can call APIs. It cannot log into a supplier portal, send an iMessage, or drive a fifteen-year-old Mac-only app. A Mac mini in the corner of the office can.
The portal wrangler
Logs into the no-API supplier portal, insurance claim system or council portal your business already runs on, and does the repetitive work. Screenshotted at every step, as evidence.
The iMessage and SMS desk
The Mac is the only sanctioned iMessage sender. Appointment reminders, support replies, delivery updates. Anything above a threshold is held for one-tap approval.
The compliance witness
Read-only session recording and a "what did the agent do" audit trail. No actuation risk at all, and it sells on its own.
Legacy Mac-only apps, and bridging two systems that each have no API. All of it runs on the same governed engine.
The gateway
Default-deny, by design.
Fifteen safety rails, R1 to R15 in the QuoxBox safety charter, stand between the agent and the machine. Each one is enforced in code by the gateway. If a rule is not enforced in code, it is not a rule.
What the rails refuse is not dropped. It is recorded on the chain, as evidence.
How much rope
Three modes.
You choose how much rope, per deployment.
mode 01
Read-only
Watches and reports. The agent sees the screen and tells you what is happening. It touches nothing.
mode 02
Propose
Plans the work and holds the risky steps for a human. Nothing risky runs until someone approves it.
mode 03
Actuate
Runs the approved plan. Still through the gateway, still default-deny, still on the record.
Human in the loop
Held for a human.
In propose mode, a risky step is held for approval from the dashboard inbox or the quox quoxbox CLI. A denial is not a dead end, it is recorded evidence. Try it: approve or deny the held step below.
held step · waiting for a human
step 04 · risk: high
finder.move · archive 12 statements
Wants to move 12 files out of ~/Statements. Held: bulk file move is above the propose-mode risk line.
a decision either way becomes a block on the chain
Approve and the step runs, verified, then lands on the chain. Deny and the refusal lands on the chain too. Both are evidence.
How you drive it
Three surfaces, one governed path.
Dashboard, terminal or any Quox agent: every route into the Mac goes through the same policy gateway and lands on the same chain.
dashboard
QuoxCORE plugin
Approval inbox, live console and evidence timeline for every governed action taken on the Mac. The demo console above echoes it.
terminal
quox quoxbox CLI
The full command set, approval inbox included.
- observe
- read <app>
- shot
- pending
- approve <id>
- deny <id>
- routine run · list · schedule
- evidence verify
plugin package
quoxbox-macmini
A collector proxy plus a POWERS mcp_endpoint, so any Quox agent can drive the Mac through the same governed path as you do.
Routines
Record once, replay governed.
Routines are named, parametric, replayable multi-step recipes for the portal work. Record a run once, then replay it on demand or on a schedule. Every replayed step is policy-checked, effect-verified and logged, exactly as a live one is. A recording never bypasses the gateway.
every replay lands on the chain · refusals included
The audit trail
Every step, provable.
Each action lands in a hash-chained, tamper-evident audit trail. You can read back exactly what the agent did, what it was refused, and why.
Data residency
On-prem, on hardware you own.
QuoxBox runs on a Mac mini in your office, not in our cloud. Credentials and the screen stay on the customer's own Mac mini; nothing but the governed, verified action leaves it.
stays on the mini
credentials · logged-in sessions · the screen and everything on it
leaves the mini
the governed, verified action and its evidence hash. Nothing else.
Where it stands
QuoxBox is in beta.
A working prototype today. Here is exactly what is shipped and what is still in development, kept separate on purpose.
working today
- A live dashboard plugin, the console above echoes it.
- The full CLI, including the approval inbox.
- The human-in-the-loop approval loop, proven end to end on real hardware.
- Governed routines, recorded once and replayed through the gateway.
- The quoxbox-macmini plugin, so any Quox agent can drive the Mac.
in development
- The first-party native actuator is in development. It is not generally available and we will not pretend otherwise.
- Natural-language chat-to-Mac, a governed agent driving the machine from a plain-English goal, on the same substrate.
beta · say beta, mean beta · follow progress in the changelog
Where the code stands
What's verified in code, what isn't yet.
The status above is the product's own claim. This is a narrower, colder read of the same ground: what this pass could actually confirm by reading the proxy, the CLI and the plugin registration.
- The governed proxy is real code, not a mock: org-scoped auth on every route, live status, workflow listing, task run and HITL approve/deny all forward to the gateway with a bearer token the browser never sees
- The quox quoxbox CLI ships real subcommands, status, workflows, tasks and the approval inbox, routed through that same collector proxy
- The dashboard plugin is registered with a manifest, a live view and a nav entry, not a placeholder route
- The gateway itself is an external service reached over HTTP from the collector; this pass verified the proxy and CLI code, not a live round trip against a running Mac mini on this box
- QuoxBox carries its own beta label on this page for a reason: the HITL loop, routines and evidence chain are shipped code paths without a dated, cross-checked status document behind them yet, unlike Qlarity or QuoxMemory
- The first-party native actuator is still in development and not generally available, per the status section below
- Natural-language chat-to-Mac is on the same substrate but not shipped
- No STATUS_AND_LIMITS_QUOXBOX.md exists yet: this band is a conservative code read, not a maturity table with live-verification evidence dates
Act, under control
Put a governed worker on the machine.
We are onboarding a small number of MSPs and regulated SMBs ahead of wider release. Read how the policy gateway, the approval loop and the evidence chain fit together, or talk to us about an early deployment.
refusals included
How you get it
Early access, by conversation
QuoxBox is not on general sale yet. It is going out to a small number of teams first, deliberately.
Talk to us
A computer-use agent you are actually allowed to deploy: it works a real desktop inside a governed boundary, with every action policy-checked and witnessed. Early access is hands-on, so we onboard each team ourselves.
Why it is gated
An agent driving a desktop is the highest-risk thing we ship. Early access exists so the policy envelope is set with you rather than guessed, before anyone runs it unattended.