◀── Back to Logs
JUN 2026 [SYSTEMS] 20 min read #SHAREPOINT#TEAMS#9OS#AI AGENT#MS TEAMS#WORKSPACE#NAMING

LOG 010.4: Building the SharePoint 9OS Command Deck and Teams Channels

LOG 010.4: Building the SharePoint 9OS Command Deck and Teams Channels

This is Part 4 of the Nine / 9OS series. Part 3 built the identity layer — the M365 account, NordVPN dedicated IP, and Conditional Access policy. This entry builds the workspace: the SharePoint site Nine operates from, the Teams command channels, and the naming architecture that makes the whole system coherent and scalable.

Series hub: LOG 010: Building Nine — A Headless AI Agent Operating Layer for Paragon9

01. THE SYSTEMS SOURCE: THE NAMING ARCHITECTURE

Before creating a single SharePoint library or Teams channel, get the naming right. This decision affects everything downstream — documentation, client deployments, future migrations, and how legible the system is to anyone who has to operate it besides you.

The system has three distinct layers. Don't conflate them:

Layer What It Is Name
The agent identity The persistent "who" — the name, the M365 account, the entity that survives runtime changes Nine
The M365 infrastructure SharePoint, Teams, Exchange — the operating environment the agent lives in 9OS
The runtime bot The software currently running the agent — this changes over time 9Claw (OpenClaw) / 9Bot (Hermes, when we migrate)

Nine is the entity. 9OS is where Nine lives. 9Claw is how Nine currently communicates through Teams.

Why this separation matters: when we eventually migrate from OpenClaw to Hermes, Nine's identity and the entire 9OS infrastructure stay constant. Only the bot name changes. Every piece of documentation, every client deployment built on this pattern, every SharePoint log entry referencing Nine — all of it remains coherent. You don't rebuild the workspace every time the runtime evolves.

The Insight: Name the layers separately because they change on different timescales. The identity is permanent. The infrastructure is durable. The runtime is replaceable. Build the naming architecture to reflect that — and you'll never have to explain to anyone why "Nine" is the same agent even though the bot name changed.

02. THE BUILD SOURCE: THE DEPLOYMENT ROADMAP

Phase 1: Create the SharePoint 9OS Site

Navigate to your SharePoint admin center or directly to https://[yourtenant].sharepoint.com.

Active sites → + Create → Team site

Click Create and wait 30–60 seconds for provisioning.

On the name: We considered several options — 9Command, 9Deck, Command9, Forge. We landed on 9OS because it's the most architecturally accurate. You're not just building a command dashboard — you're building an operating system layer for the agent. paragon9.sharepoint.com/sites/9OS reads exactly right.

Phase 2: Create the Five Document Libraries

Nine's workspace needs five document libraries — not folders. Libraries give you proper metadata, versioning, and per-library permission scoping. That last point matters when we lock Reference to read-only in Phase 4.

From the 9OS site home page, create each library via + New → Document library:

Library Description
Inbox Tasks and requests staged for Nine to act on.
Outbox Completed deliverables staged for human review before release.
Drafts Email drafts, proposals, and documents in progress awaiting review.
Reference Documents and resources explicitly granted to Nine for context and retrieval.
Research Finished research artifacts and media produced.
Logs Activity logs, decision trails, and audit records for all Nine operations.

Create them one at a time and verify each appears in site navigation before creating the next.

Note: SharePoint auto-creates a default Documents library. Leave it — don't delete it. Nine will have six libraries visible; five are operational.

Phase 3: Scope Nine's Permissions at the Site Level

When you added [email protected] as a member during site creation, SharePoint may not have actually added it to the members group. Verify this before proceeding.

Navigate to Site Settings (gear icon) → Site permissions → Advanced permissions settings

Click on 9OS Members and check whether [email protected] is listed. If it isn't:

Click Grant Permissions at the top of the page:

Click Share to confirm.

Phase 4: Lock the Reference Library to Read-Only

Nine can read from Reference but cannot modify it. This is where you place client briefs, templates, and reference material Nine needs for context — without any risk of the agent overwriting the source documents.

Navigate to the Reference library → gear icon → Library settings → Permissions for this document library

Click Stop Inheriting Permissions and confirm the warning dialog.

Find [email protected] in the permissions list, check its checkbox, click Edit User Permissions, and change from Contribute to Read. Click OK.

On populating Reference: You don't need to copy documents in from other SharePoint sites. Use SharePoint Shortcuts to create links to documents on other sites — they appear local but aren't copies. You'll need to create a share link from the source document and add it as a link to the Reference document library. For documents that should flow in automatically, Power Automate can watch source libraries and sync to Reference on change. Both approaches can coexist: shortcuts for standing reference material, Power Automate for dynamic content.

Phase 5: Create the 9OS Teams Team

Open Teams and navigate to Teams → Join or create a team → Create team → Private

Click Create. When prompted to add members, add [email protected] as a Member — not Owner.

Phase 6: Create the Four Command Channels

Create each channel via three dots (...) next to the 9OS team → Add channel:

For each channel:

Channel Description
tasks Drop tasks and requests here for Nine to act on.
drafts-review Completed drafts staged by Nine for human review before release.
research Research requests and synthesis outputs from Nine.
code-review Code review requests and PR summaries staged by Nine for human approval.

The routing logic is intentional and worth stating explicitly:

Nine needs write access to three channels. The tasks channel is inbound only — it's how you issue work, not how Nine responds to it.

Phase 7: Install 9Claw in the 9OS Team

Nine communicates through the Teams bot — 9Claw in this deployment, named after the OpenClaw runtime. The bot needs to be installed at the team level so it can post to all channels.

In Teams: 9OS team → three dots (...) → Manage team → Apps tab → Upload an app

Select your OpenClaw bot zip file and install it scoped to the 9OS team.

When prompted to choose a channel, select any one — it doesn't matter which. Team-level installation gives the bot access to all channels. You do not need per-channel installation.

Note: After installation, if you try to add the bot to additional channels through the Apps list it will show as already installed. This is correct behavior, not an error.

Phase 8: Register Each Channel with the Bot

OpenClaw's bot framework only registers a channel conversation when there's an actual message interaction — installation alone is not enough. @mention the bot in each channel to trigger registration.

In each of the four channels, send:

@9Claw hello

The bot should respond in each channel. After all four, verify the channel registrations on the OpenClaw machine:

cat ~/.openclaw/msteams-conversations.json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for cid, conv in data['conversations'].items():
    ctype = conv['conversation']['conversationType']
    print(f'Type: {ctype:10} | ID: {cid[:35]}...')
"

You should see:

⚠️ Gotcha #6 — Two groups named 9OS in the Graph API

When you query Microsoft Graph for the 9OS team by display name, you'll find two groups named 9OS. SharePoint creates a backing Microsoft 365 group when you provision a Teams team, resulting in a duplicate name.

To identify which group is the actual Teams-enabled one, check the resourceProvisioningOptions field:

python3 << 'EOF'
import json, urllib.request, urllib.parse

with open('/home/paragon9/.openclaw/msgraph.json', 'r') as f:
    mg = json.load(f)

data = urllib.parse.urlencode({
    'grant_type': 'client_credentials',
    'client_id': mg['clientId'],
    'client_secret': mg['clientSecret'],
    'scope': 'https://graph.microsoft.com/.default'
}).encode()

with urllib.request.urlopen(
    urllib.request.Request(
        f"https://login.microsoftonline.com/{mg['tenantId']}/oauth2/v2.0/token",
        data=data, method='POST'
    )
) as r:
    token = json.loads(r.read())['access_token']

filter_query = urllib.parse.quote("displayName eq '9OS'")
with urllib.request.urlopen(
    urllib.request.Request(
        f"https://graph.microsoft.com/v1.0/groups?$filter={filter_query}&$select=id,displayName,resourceProvisioningOptions",
        headers={'Authorization': f'Bearer {token}'}
    )
) as r:
    for g in json.loads(r.read())['value']:
        is_teams = 'Team' in g.get('resourceProvisioningOptions', [])
        print(f"ID: {g['id'][:8]}... | Teams-enabled: {is_teams}")
EOF

Use the ID where Teams-enabled: True.

03. THE LEGACY SOURCE: THE WORKSPACE IS LIVE

At this point Nine has a place to work, a structured way to receive tasks, and defined channels for where output lands.

 ✔ SharePoint 9OS site — private, scoped, provisioned
 ✔ Five document libraries — Inbox / Outbox / Drafts / Reference / Research / Logs
 ✔ Reference library locked to Read-only for [email protected]
 ✔ Teams 9OS team — private, agent as member
 ✔ Four command channels — tasks / drafts-review / research / code-review
 ✔ 9Claw bot installed at the team level
 ✔ All four channels registered via @mention

The workspace isn't just file storage and chat rooms. It's the audit trail. Every task Nine receives comes through the tasks channel. Every deliverable Nine produces lands in Outbox before it goes anywhere. Every significant action Nine takes gets logged to the Logs library. The structure enforces accountability without requiring a custom framework — it uses the infrastructure Microsoft already built and that you already pay for.

Nine has an identity. Now Nine has an address. The final entry in this series wires the two together.

The Lesson: Structure defines what accountability looks like in practice. A well-organized workspace isn't overhead — it's the difference between an agent you can begin to trust and one you have to watch constantly.

[SYSTEM NOTES]

Stay Resilient.

— Greg Scott Kirk (Tek)

Part 4 of the Nine / 9OS series.
← Previous: LOG 010.3: Setting Up a Dedicated M365 Identity for Nine
→ Next: LOG 010.5: Connecting OpenClaw to Microsoft Graph and Bringing Nine Online

// NEXT ACTION

This is the architecture Paragon9 installs for mid-market firms — modernized, documented, and built to run without its operator. If you want it running in your business, the conversation is free.

// Book a Free 30-Min Strategy Call // Unlock Gated LOGs — Free