YC's QM: Enterprise Agent Platform Solving Personal Assistant Scale Limits

Background: Personal Agents vs. Enterprise Needs

Personal coding agents like Deepseek Harness, Pi Agent, and Prime Agent work well for individuals but break down when scaled across a company: shared contexts and credentials become a mess, and there is no built-in permission or audit model.

QM's Core Architecture: Scope-Based Isolation

QM (Quartermaster) treats scope as the fundamental unit. Each person and each Slack room gets an independent set of:

Independent memory

Independent files

Independent Keychain (credential management)

Independent permissions

Independent scheduled tasks

Independent persistent sandbox

For example, finance email credentials never leak into the engineering sandbox. This isolation is baked into the architecture, not achieved via prompt engineering.

Enterprise Security Model

QM provides three security modes:

Strict : every tool call requires human approval.

Auto (default): a classifier screens external data before sending it to the model.

Dangerous : all calls pass through, but destructive operations (recursive deletes, destructive SQL) are hard-blocked by command policies in all three modes.

Full audit logging captures every outbound call and action, traceable to the user and scope.

Model Agnosticism

The core is decoupled from the model driver. Pi, Codex, OpenCode, Claude Code, and others can drive the same QM core; the previously covered Pi Agent is already supported.

Deployment and Admin Console

QM is organizational software, not a desktop app, targeting teams of 10–500. It requires a cloud account and Postgres (Fly.io or AWS). Deployment does not even require cloning the repo:

npm exec --yes --package=@yc-software/qm@latest -- qm init . --org your-company --target fly

qm init

generates deployment scaffolding and walks through infrastructure, login (default email magic link, swappable to Okta or other IdP), credential integration, and optional Slack. Admins get a dedicated console to manage users, permissions, audit logs, and available models — model choice is a company policy, not personal preference.

Web UI and Multi-User Collaboration

The sidebar shows Projects, Files, Crons, Keychain, Deploys, Memory, and Skills. In testing:

Memory follows scope, not chat window: telling QM "Remember: our team has a project meeting every Friday afternoon" and then switching sessions still yields the correct answer.

Room contexts are shared within a channel; private spaces stay invisible to others.

File sharing is permission-based; projects are naturally isolated.

Three Standout Characteristics

Isolation is an architectural default, not a prompt trick. Context pollution is solved at the design layer.

Audit and approval are built-in. No more running agents naked; every step leaves a trace and is accountable.

Agents can build and publish internal web apps to specific people. Crons, watches, and webhooks enable unattended background tasks.

Conclusion

QM is not a drop-in replacement for OpenClaw or Hermes; it upgrades agents from "personal productivity tools" to "company infrastructure." Personal assistants manage individual efficiency; QM manages organizational boundaries. YC itself labels it "early and buggy" and recommends a small-scale pilot before broad rollout. Teams evaluating an agent foundation should bookmark this repository now.

Project link:

https://github.com/yc-software/qm