The agents: what makes it agentic
Each agent has one job, a narrow set of tools, and a person who approves what it proposes. Nothing reaches your machines until it has been tested and you have said yes.
Agentic installs, in order
1. Learn: the install lab
A product specialist agent per product learns how that product installs on clean, disposable lab machines before it is trusted. Chrome, Firefox, Acrobat Reader, VS Code, 7-Zip, Notepad++ and KeePass have passed the lab as the system account on Windows Server 2022.
2. Verify
The installer must be signed by that product's pinned publisher and pass a malware scan.
3. You approve, and patches wait
A person consents before anything installs: each one, or once by opting into scheduled patching. A patch with a threat or the wrong publisher is held for every machine until someone looks, and patches roll out in rings: a test group first, then wider.
4. When an install fails at your site
The agent steps in: it picks one fix from a fixed list of safe actions (retry machine-wide, close the app and retry, use the other verified installer, or stop and report), your machine checks the choice against your policy, and every step is logged. It never runs a command it made up.
Agents that keep the data right
The repair loop
When a vendor source fails, an agent proposes the missing releases from the vendor's own pages after the daily build. Code re-verifies every proposal, and one reaches the patch data only after it verifies on three separate days.
The Lookout
A watch service over every place the repository reads. It spots new items as vendors publish them, and the silent changes too: a vendor page that changed shape while the data still looked fine. The AI proposes; code never deploys itself.
Supersedence, per product line
Which update replaces which is how you install only what is needed. Each product line, Firefox ESR beside Firefox or a Java release line beside the next, gets its own model, and a Supersedence agent per product proposes and cross-checks. For Microsoft, supersedence stays deterministic.
