Write the machine before the agent: one program per role.

DEFINE MACHINE office_assistant AS (
  PROFILE hosted, ARCH x86_64, KERNEL linux
) RATIONALE "An office assistant: the model reads, one world speaks"

DEFINE CAPABILITY inference AS (GRANT yes)
  RATIONALE "The model runs on this box, not at a vendor"
DEFINE CAPABILITY filesystem AS (GRANT yes)
  RATIONALE "Each world keeps only the disks it names"
DEFINE CAPABILITY network AS (GRANT yes)
  RATIONALE "One world answers the people in the office"

DEFINE MOUNT models AS (
  AT "/models", FS ext4, DEVICE "/dev/vda2",
  OPTIONS [ro, noexec]
) RATIONALE "The weights: read, never changed, never run"

DEFINE MOUNT exchange AS (
  AT "/exchange", FS ext4, DEVICE "/dev/vda3",
  OPTIONS [rw, noexec]
) RATIONALE "Where the two worlds meet: questions in, answers out"

DEFINE NETWORK office AS (
  INTERFACE "eth0", ADDRESS "192.168.1.20/24",
  EGRESS none
) RATIONALE "The office's own network, and no route beyond it"

DEFINE USER reader AS (UID 1001)
  RATIONALE "The model runs as someone, never as the machine"
DEFINE USER clerk AS (UID 1002)
  RATIONALE "The world that answers people is someone else"

DEFINE SERVICE model AS (
  RUN ["/app/model"], RESTART always, USER reader,
  NEEDS [inference, filesystem],
  SEES [models, exchange],
  MEMORY 4096, CPU 200,
  STATE ["/run/model"],
  READY "/run/model/ready"
) RATIONALE "Reads weights and questions; no network, no new process"

DEFINE SERVICE desk AS (
  RUN ["/app/desk"], RESTART always, USER clerk,
  NEEDS [network, filesystem],
  SEES [exchange],
  MEMORY 256,
  STATE ["/run/desk"],
  READY "/run/desk/ready"
) RATIONALE "Answers the office, and never sees the weights"