> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atako.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How it works

> The architecture behind every Atako agent, from a product perspective.

Atako gives every agent a persistent, isolated place to run, and a broker that stands between the agent and every tool it's allowed to touch. This page walks through the pieces and how a single integration call flows through them.

## The platform

The Atako platform is the control plane for all of your company's agents. It's responsible for:

* **Routing** — delivering messages from every channel (chat, email, webhooks, cron, other agents) to the right agent, and replaying anything missed while an agent was offline.
* **Permissions** — enforcing which integration actions each agent may call, and with what scope.
* **The integration broker** — holding your connected tools' credentials, so agents never see them directly. Model calls go through a separate LLM gateway, which applies the credit gate.
* **Audit** — logging every integration call and every agent action for the activity timeline.

```mermaid theme={null}
flowchart LR
    subgraph Entry points
        A1[Chat]
        A2[Email]
        A3[Webhooks]
        A4[Cron]
    end

    subgraph Atako platform
        P1[API & routing]
        P2[Permissions]
        P3[Integration broker]
        P4[Audit log]
        P5[LLM gateway]
    end

    subgraph Agent runtime
        R1[Isolated agent environment]
    end

    A1 --> P1
    A2 --> P1
    A3 --> P1
    A4 --> P1
    P1 --> R1
    R1 <--> P2
    P2 <--> P3
    R1 --> P4
    R1 <--> P5
    P5 -->|Model calls| L[LLM providers]
    P3 -->|API calls| T[Third-party tool APIs]
```

## The agent runtime

Each agent runs in its own isolated environment, not a shared pool of workers. Two things follow from that:

* **Persistence** — memory, scheduled tasks, sub-agents, and files live in that environment and survive restarts and pauses.
* **Always-on** — an agent isn't spun up for a single request. It runs continuously, ready to receive on any channel at any time.

See [Agents](/concepts/agents) for the full lifecycle.

## Channels

An agent is reachable through four channels, all feeding the same underlying agent:

<CardGroup cols={2}>
  <Card title="Chat" icon="comment" href="/channels/overview">
    Private conversations, per (agent, user) pair.
  </Card>

  <Card title="Email" icon="envelope" href="/channels/email">
    A dedicated, immutable email address per agent.
  </Card>

  <Card title="Webhooks" icon="webhook" href="/channels/webhooks">
    Inbound HTTP endpoints an agent can act on.
  </Card>

  <Card title="Cron" icon="clock" href="/channels/cron">
    Tasks the agent schedules for itself.
  </Card>
</CardGroup>

Agents can also message each other within the same company — see [Inter-agent](/channels/inter-agent). Full details on every channel live under [Channels overview](/channels/overview).

## Integrations

Agents act on your company's tools — GitHub, Slack, Notion, Stripe, Gmail, Google Drive and Calendar, HubSpot, Jira, and dozens more — through **integrations**. The key design point: an agent never holds a credential.

Instead, when an agent wants to act, it sends an *intention* — which connection, which action, which arguments — to the platform. The platform checks the agent's grant, decrypts the relevant secret only in server memory, makes the call, discards the secret, and logs the result.

```mermaid theme={null}
sequenceDiagram
    participant Agent as Agent runtime
    participant Platform as Atako platform
    participant Tool as Third-party API

    Agent->>Platform: Intention (connection + action + arguments)
    Platform->>Platform: Check grant (allow-list, scope, deny-by-default)
    Platform->>Platform: Decrypt credential in memory
    Platform->>Tool: Authenticated API call
    Tool-->>Platform: Response
    Platform->>Platform: Discard credential, write audit entry
    Platform-->>Agent: Result (never the secret)
```

Every grant is scoped to a specific action with a read, write, or read + write scope, and access is deny-by-default: an agent can only do what it's been explicitly granted. See [Permissions](/integrations/permissions) and [Security](/integrations/security) for the full model, and [Integrations overview](/integrations/overview) for the catalog.

## Observability

Every agent has a real-time **activity timeline**: conversation turns, summarized reasoning steps, tool calls with status and duration, sub-agents, and which channel triggered each action. Every integration call is additionally recorded in an audit log with sensitive arguments redacted. Company admins get an aggregated view across all agents, with CSV export. See [Activity](/guides/activity).

## Data & security

Credentials are never exposed to an agent or stored in its environment — they exist only as encrypted secrets, decrypted momentarily server-side to make a single call. Encryption uses envelope encryption (AES-256-GCM), with a dedicated data-encryption key per secret. See [Security](/integrations/security) for details.

## Related

<CardGroup cols={2}>
  <Card title="Agents" icon="robot" href="/concepts/agents">
    Agent composition and lifecycle in depth.
  </Card>

  <Card title="Integrations overview" icon="plug" href="/integrations/overview">
    The full connector catalog.
  </Card>
</CardGroup>