How AgenticFS Redefines Storage for AI Agents: From Shared Directories to Independent Workspaces

Background

AI industry is shifting focus from model intelligence to data foundation. As agents evolve into autonomous systems that call tools, execute tasks, and interact with environments, the traditional file system—designed for human users—becomes a bottleneck. Each agent needs an isolated workspace, secure access, and elastic resources, but classic NAS assumes a few human users sharing a single instance.

Challenges of the legacy paradigm

Scale ceiling. Millions of agents require separate mount points and quotas. Traditional NAS supports 10‑20 billion files but only thousands of directory quotas, forcing operators to split dozens of file‑system instances, which explodes operational complexity.

Isolation dilemma. A rogue agent can fill the entire filesystem or saturate metadata QPS, causing a cascade failure for all agents sharing the same namespace. NAS cannot provide per‑agent performance or capacity isolation.

Security blind spot. Prompt‑injection attacks can drive agents onto destructive paths. NAS ACLs are coarse‑grained (filesystem‑ or directory‑level) and cannot enforce zero‑trust credentials for each agent, exposing all data if one agent is compromised.

AgenticFS architecture

The core idea is “from a single filesystem with directories to each Agent Workspace mapping to an independent storage space.” AgenticFS introduces AgenticSpace : an independent inode space, mount point, quota, and performance resources per agent. Thousands of AgenticSpace instances compose a logical AgenticFS that is presented as a region‑level super filesystem.

Region‑level design aggregates millions of AgenticSpace instances across availability zones and physical clusters, providing linear metadata scaling (metadata QPS reaches billions) and eliminating single‑instance bottlenecks. A single mount of the AgenticFS root gives read‑only access to all workspaces, simplifying backup, log analysis, and compliance.

Isolation and resource guarantees

Each AgenticSpace enforces dual‑dimensional quotas (up to 1 PiB and 1 billion files) to prevent “storage farming” and metadata explosion. Performance isolation covers throughput, IOPS, and metadata QPS, so a misbehaving agent cannot starve others. Mount and unmount QPS reach 100 k, with end‑to‑end latency converging to seconds, meeting sandbox‑level elasticity.

Independent data and metadata partitions limit fault impact to a single workspace, avoiding cross‑tenant avalanche effects.

Zero‑trust access

AgenticFS adopts a “platform‑proxy authentication” model: the platform uses a single Alibaba Cloud account to manage millions of agents, while the service only sees “platform‑on‑behalf‑of‑Agent requests.” Each AgenticSpace receives a temporary STS credential; credentials are stateless, horizontally scalable to 100 k QPS, and auto‑rotated, reducing attack windows to seconds and eliminating long‑lived credential leakage.

Control‑plane and data‑plane co‑location

Traditional storage separates control and data planes, creating a performance bottleneck. AgenticFS colocates the control system with the data plane, inheriting the data‑plane’s horizontal scalability. This enables 100 k QPS for workspace creation, deletion, and mount operations, supporting bursty agent workloads.

Integration with the Agent stack

AgenticFS is not a standalone product; it is the storage foundation for Alibaba Cloud’s Agent ecosystem. It reuses the Pangu file system and Alibaba Cloud file‑storage service (full‑flash clusters, multi‑replica, strong consistency). It inherits cloud features such as POSIX compatibility, elastic scaling, and shared access.

Compute forms (ACS Agent Sandbox, Function Compute sandbox) request and mount a dedicated workspace via the CreateAgenticSpace OpenAPI, achieving second‑level provisioning and mounting latency.

Horizontal ecosystem integration

AgenticFS tightly integrates with existing cloud services: RAM/STS for zero‑trust identity, CloudMonitor and SLS for capacity, performance, and metadata QPS metrics, CloudBackup for immutable per‑workspace backups, and Log Service for full audit trails. These integrations provide observability, auditability, and recoverability without additional platform effort.

Conclusion

AgenticFS demonstrates that storage for the Agent era must be natively designed rather than retrofitted. By providing independent, secure, and elastic workspaces at massive scale, it removes the traditional storage bottlenecks and enables AI agents to be deployed reliably at billions‑scale workloads.