Chapter 6. Why an operating system

A working draft, November 2026. This book is being written while The Grove is being built; expect it to change. Checked against the build as it stood on 1 November 2026.

In this chapter

• Why culture alone erodes under pressure, and what written practices like Holacracy ask of people
• What it means to run on an operating system, with each organisation's shape held as its own data
• Why the work flows through the structure, rather than past a map beside it
• Which few guardrails live in the structure itself, and how a founder's last word was closed off
• How the network is meant to be run by its members, like Visa, and where it stands today
• Why the Internet Computer: independence all the way through, with no single owner beneath the organisation who could take it away or use it as leverage

If you've followed us this far, you might agree with most of it and still have a fair objection.

All of this sounds like culture. Living organisations, sensing and responding, people taking up responsibility rather than having it handed to them: these are questions of how people behave and what they believe. Culture is built through leadership, conversation, trust and time. It isn't something you can install. If anything, the history of organisational change is littered with software that promised to transform how people work and ended up as one more system to log into.

So why build an operating system at all?

What culture alone costs

We have a lot of respect for culture. But we've also watched what happens to it under pressure.

A team agrees to make decisions together. It works well for a while. Then a deadline lands, someone senior is anxious, and a decision gets made in a corridor. Nobody objects, because it's urgent and it's only this once. Next time it's easier. Within a year the team is deciding things the old way and talking about the new way at offsites.

This isn't a failure of good intentions. It's what happens when the only thing holding a new way of working in place is everyone's goodwill on a bad day. Old habits have generations behind them. New ones have a workshop and a poster.

The practices that went furthest beyond hierarchy knew this, which is why they wrote things down. Holacracy has a constitution, roles written with their purpose and accountabilities, a governance process with its own rules, and meetings with a facilitator and a secretary to keep it all honest.¹ It's a serious answer to the drift. But it asks a lot of people. Someone has to run the meetings. Someone has to keep the records. Someone has to know the rules well enough to spot when they're being bent. And the record of how the organisation is meant to work usually lives in a separate place from the work itself: a map of the organisation, consulted now and then, while the real work happens in email, chat and spreadsheets.

When people get busy, the map falls out of date, the meetings slip, and the old shape grows back underneath.

The thing everything else runs on

Think about the computer you use every day. You probably don't think much about its operating system. You open a window, and a programme runs. You save a file, and it's there tomorrow. Two programmes don't overwrite each other's work. One crashing doesn't take the others down. None of that happens because the programmes are well behaved. It happens because the operating system underneath provides the means for them to run, and the rules they have to run within.

That's the kind of thing we set out to build: not another tool that sits on top of an organisation, but the layer underneath that organisations run on. An organisational runtime.

The comparison holds further than you might expect.

The hardware is a blockchain, the Internet Computer. When The Grove opens to everyone, each organisation will be its own independent DAO: its own small, self-contained piece of that network, running its own copy of the operating system, with its own DNA growing in it, and controlled by nobody else. That's the shape The Grove goes live in. Before then, while we test the design, the experience, scale and security, the organisations on The Grove are simulated ones, seeded, grown and run by AI people. That's a test bench, not the live system.

That makes every organisation on The Grove a DAO from its first day: a decentralised autonomous organisation, whose rules are carried out by code its people agreed rather than by an officer. Even on the test bench its rules run as code; what going live adds is the independence. Most DAOs ask their members to buy tokens, hold a crypto wallet and pay a fee, often called gas, every time they act. Nobody in an organisation on The Grove does any of that. The only part of the blockchain anyone touches is signing in, with Internet Identity, the Internet Computer's own way of proving it's you, using the passkey on your phone or laptop rather than a password. Nobody holds a token, pays to act or handles cryptocurrency, and the organisation's money stays in its own bank. The blockchain is underneath, doing its job, and out of sight.

The governance is where the difference runs deepest. Most DAOs decide by token: one token, one vote. So whoever holds the most tokens holds the most say, and say can simply be bought. Much of what has gone wrong with DAOs follows from that. Votes cluster in a few large holders, most members stop taking part, and in the worst cases someone buys or borrows enough tokens to push through a proposal that empties the treasury. In 2022 an attacker did exactly that to a project called Beanstalk, borrowing the votes for a single transaction. In an organisation on The Grove, money can never buy a say. The say comes from trust that peers give and can take back, consent from the people who carry the work, advice from those it touches, and a clock on every stage, as the chapters on decisions and trust describe. That is a different thing from a token vote, and it's the main reason we think a DAO can work for ordinary organisations at all.

The operating system provides the means an organisation needs to run: ways to sense what's happening, make decisions, route work to where it belongs, keep promises, handle money, and see itself whole. And it provides the guardrails: the few rules every organisation carries, which stop it drifting back into the old shape when people are tired or under pressure. And it's agentic. Its AI, Wise-Eye, is built in beside every seat, so an organisation has a companion that reads, routes, drafts, makes sense of what's happening and learns how this organisation works, from the day it's planted, without anyone having to integrate one. Chapter 22 says where.

The programmes are each organisation's DNA: its purpose, its parts, its agreements, its playbooks, the way its work is done. That's what runs on the system, and it's what makes an organisation that organisation rather than any other. It's data, written and changed by the people in the organisation, through the organisation's own processes. The system doesn't decide what shape an organisation should be. It runs whatever DNA the organisation grows, and makes it easy to change.

And each organisation's files are its own records: what it decided, what it promised, what it learned, kept as the work happens. The organisation itself is its people, with its DNA running beneath them.

Working in it, not on it

There's a difference between a map of an organisation and the place where the organisation actually works.

Most tools for self-management are maps. They record the roles, the circles, the policies. You go there to look things up, and to change the structure in a governance meeting. Then you go back to your email to do the work.

From the start, we wanted the opposite. Work arrives in the organisation and goes straight to the part that answers for it. A proposal to change how things are done is made where the work is happening, by the people doing it. The structure isn't a diagram beside the work; it's the thing the work flows through. So when the structure is wrong, you feel it in the work, and the work itself shows where.

That's the deeper reason for an operating system rather than a tool. A tool is something you pick up and put down. An operating system is where you are. And because each organisation on The Grove is a DAO, its decisions, its records and its rules living in its own running code, The Grove isn't something the organisation uses. It's the form the organisation takes.

Guardrails, not instructions

The guardrails are worth a closer look, because they're the answer to the culture objection.

The legal scholar Lawrence Lessig made an argument in the late 1990s that has only grown more relevant: in the digital world, code regulates behaviour as surely as law does.² The way a system is built makes some things easy, some things hard and some things impossible, whatever anyone intends.

That cuts both ways. Most software for organisations quietly enforces hierarchy: approval chains, managers who can see their reports' work but not the other way round, dashboards built for the top. Nobody voted for any of it. It's just how the tools were built.

So we built the other way. It's easiest to see in a moment.

Picture a small organisation on The Grove, a few months old. The person who started it holds the root, the seat that carries the organisation's purpose. Two others hold seats on the parts beneath it. A large order has come in, and the founder knows exactly who should take on the new kitchen work: herself. So she starts a proposal to seat herself on that part.

It doesn't go through. The words she sees are plain: a seat is never taken by your own proposal. Someone else seated in the forum around that branch's parent has to raise it, and when it's decided, she stands aside from it, because it's about her.

That isn't a policy she forgot to read. There's no setting that turns it off, and nobody to ask for an exception, because there's nobody above the forum to ask.

The same goes for the shortcut everyone takes when a deadline lands, the decision made in a corridor. With two people seated in a forum, nothing passes the moment one of them says yes. There's a window of two days in which the other can see it and answer. A concern holds the change until it's met, reshaped or lifted by the person who raised it, and nobody else can lift it for them. A change big enough to matter waits a few more days after it's agreed, and a concern raised in those days stops it. Each time we found a place where a founder could quietly keep the last word, we closed it. At one point a founder could add new structure in a single step, with no measure and no look back. Now that step is refused.

There's no override anywhere: no veto, no administrator, no emergency switch. The obvious question is what happens when the building's on fire, and we come back to it when we look at decisions in Chapter 11.

A founder alone still decides alone. There's nobody else to ask, and pretending otherwise would be theatre. The rules begin to bite the moment a second person takes a seat, and that's deliberate. The guardrails don't stop you starting. They stop you staying the boss.

A few more things are held the same way. Money can fund the work but can't buy a say: the money and the say are kept apart in the system, with no way to turn one into the other. Nobody inside an organisation can quietly change the rules for everyone else. And no reading of the organisation is ever about a person.

We should be honest that not everything is held this way. Some of what keeps Wise-Eye, the system's AI, in its place is structure: it has no way to consent to a proposal, so it can't. Some of it is words: its guidance asks it never to tell people what they should do, and that holds only as long as the model listens. Thomas Thomison, who co-founded HolacracyOne, puts the difference well: a prompt is not a constitution.³ Wherever it matters, we've tried to move a rule from the second kind to the first. When we caught Wise-Eye writing a customer's phone number into guidance the whole organisation reads, we didn't write it a better instruction. The system now refuses to keep it.

That's the answer to the culture objection. Not that culture doesn't matter, but that a tired team on a bad Friday shouldn't need to remember the rules for the rules to hold.

Everything else is left to the organisation. The guardrails are few, on purpose. They mark the edges of the road, not the route.

Run by its members, like Visa

There's one more question: who runs the system?

If one company owns the platform that organisations run on, that company holds all the power, however good its intentions. It can change the rules, raise the price, or be bought by someone with different intentions. An operating system for organisations without bosses would have quietly put a boss back on top of all of them.

The nearest model we found is an unlikely one: Visa. In the late 1960s, Dee Hock helped turn a struggling credit card programme into an organisation owned and governed by the banks that used it, neither a single company nor a free-for-all, which he later called chaordic: a blend of chaos and order.⁴ The network existed because its members ran it together.

The Grove is designed on a similar idea, and this is the part we're furthest from finishing. The plan is that organisations form a network by recognising each other. The network has a Steward, in place from the day The Grove goes live, which is itself an organisation like any other, bound by the same rules, whose job is to look after the system's code for the organisations that use it. Every organisation will carry the system with it, sealed inside its own space. Nobody will be able to push changes into an organisation; each will decide for itself whether to adopt a new version. And if a Steward ever stopped serving its network, the organisations could leave together, take the system with them, and form a network of their own.

That isn't how the test bench works. While the organisations are simulated and we're still testing, they share one space and we can change the code they all run on, because we need to. Going live means the shape above: each organisation its own DAO, running its own copy, making its own choices. We built the organisation first and the network second, because a network of organisations that can't yet run themselves would be worth nothing. Until The Grove goes live, that gap is real, and we'd rather name it than have you find it.

How the network will work, and why it isn't simply open source, is a story for later in the book. For now the point is simple. The system is being designed so that capturing it would be worthless.

How we decided

We didn't start out building an operating system. We started with governance: a way for an organisation to run itself without a boss, expressed in code. Very early, we found that governance alone wasn't enough. An organisation that can make decisions but can't route its work, keep its promises or see its own state isn't much of an organisation. Layer by layer, what began as governance became the whole runtime.

We argued about the word. Platform sounded like someone else's property. Tool sounded like something you could put down. App sounded small. Operating system was the only term that captured both halves: the means to run, and the rules to run within. Holacracy's creators had used it too, for a practice written on paper.¹ We wanted one that actually runs.

We also had to decide how much to build in. It would have been easy to encode a particular way of organising, ours, and make every organisation follow it. We chose not to. The guardrails are the few things we believe must hold for any organisation without a boss to stay that way. Everything else is the organisation's own DNA. The code is only the ground it grows in.

And we chose a blockchain not because it's fashionable but because it answers a specific question: where can an organisation live so that nobody, including us, can switch it off, read its private records or change its rules from outside? Put another way: how does an organisation stay independent all the way down, with no single owner beneath it, of servers, software or sign-in, who could take it away or use it as leverage? The Internet Computer answered that better than anything else we looked at, for six reasons.

• No single point of control. Most businesses today run on tools that sit in a few large clouds. When one of those has a bad day, thousands of businesses go down together, and whoever owns the servers sets the terms. On the Internet Computer, a piece of software, called a canister, runs on many machines at once, held by independent operators in different countries, and they have to agree on every change to its state. No one of them can switch it off or quietly alter it.
• Room for a whole system. The smart contracts most DAOs run on are tiny. On Ethereum, a contract's code is capped at twenty-four kilobytes: room for a voting rule, not an organisation. A canister holds a full application and its data, which is why the whole operating system, guardrails and all, lives in one place rather than spread across contracts and outside servers.
• One place, not a stack. The canister itself serves the page people use, the organisation's own website, and the data behind both. There's no separate web host or database to run, secure or lose.
• The organisation pays, not its people. A canister pays for its own computing, from a balance topped up in advance and priced against ordinary currencies rather than a token's swings. That's what lets members act without wallets or fees.
• Signing in that protects people. Internet Identity uses the passkey already on a phone or laptop, so there's no password to steal, and it gives each person a different identity on every site, so they can't be followed from one to the next.
• Only its controllers can change it. A canister's code can be replaced only by whoever controls it, and the network keeps a public fingerprint of the code that's installed, so a change can't happen unseen. At go-live, control passes to each organisation's own decision-making, so its code changes only when its people decide it should.

Each of these takes away one thing an organisation would otherwise depend on someone else for: the servers, the size of what it can hold, the hosting, the fees, the sign-in, and the right to change its code. Together they're what independence all the way through means. This is what Chapter 1 meant by a sovereign organisation: nothing it stands on is owned by someone who could pull it away. Keeping a boss from growing inside is the guardrails' job, and a different one. The last is the one that completes it, and it's the property we're building towards. We aren't there yet.

What you might take from this

Culture matters, but culture alone erodes under pressure. Rules that live in the structure of the system itself don't depend on everyone's goodwill on a bad day.

Independence has to run all the way down. An organisation without a boss inside can still have one outside: whoever owns the servers, the software or the sign-in it can't do without. So the question to ask of any foundation is who could take it away, or use it as leverage, and the answer we're building towards is nobody. That's what makes an organisation sovereign.

That's why an operating system: the means to run without a boss, and the few guardrails that stop the boss growing back.

Notes and further reading

On the social potential movement, the step from what one person can become to what we can become together: Hubbard, B. M. (1998), Conscious Evolution: Awakening the Power of Our Social Potential, New World Library. On how token voting concentrates power in DAOs, and where it has failed: Buterin, V. (2021), "Moving beyond coin voting governance", vitalik.ca.