Agents and trust

The brief is a sealed contract

Before any work starts, the brief pins every input by hash and declares done, cannot-be-done, budget, scope and commands. It is identified by the digest of itself.

Everything on this page holds for any agent, person or AI. For an AI agent, the workspace is a sandbox, the timebox is a token budget and a handoff is a new session; for a person, they are a scoped task, a deadline and a new hire.

Everything the run may use, and everything it must achieve, is fixed before the run begins. Each part is marked read-only or writable. The brief never carries its own digest, so it is final the moment it exists.

An agent knows what it is doing, knows when it is done, and has a legitimate way to say it cannot finish.

The budget is a timebox, sized against the task length the agent completes four times in five, not the length it completes half the time. Measured on AI agents, the first is four to ten times shorter than the second; Big work becomes small, checkable tasks explains why that matters. A budget is a fuse, not a decision: exhausting it ends the run, while crossing the estimate factor puts a question to the issuer.

Who accepts a brief. A brief needs the owner’s acceptance if and only if it is cascading, irreversible, frame-extending or intent-bearing. Otherwise its issuer accepts it, at any depth. A brief cascades if it will be decomposed further, so an agent that issues a leaf sub-brief accepts it, and a sub-brief that branches reaches the owner however deep it sits.

Least privilege is absence, enforced three times

A run sees only the commands its brief declared that its actor also holds. Everything else does not exist — and the server re-checks every call anyway.

The harness grants exactly the brief’s declared commands, intersected with the actor’s capabilities. An undeclared command is not refused — it is never presented. A brief that declares a capability its own issuer does not hold is malformed, and is caught before it is issued.

Everything an agent does, it does through one command server, so that server is the policy enforcement point, at the three moments above. It speaks the Model Context Protocol, an open protocol for exposing tools to AI agents, which the scheme uses as the one tool surface for every agent. The command catalogue is large, and no agent ever sees it whole.

Hiding a tool is not a boundary. Every call is authorized again.

Narrow the task, widen the reading

A run writes one small, exclusive region and reads far more. Only identities, names, types and simple structures cross between units, and every brief must pass an independence test.

A brief grants write access to a small, exclusive region and read access to much more. Coordination through an artifact only works if the artifact can be read. Restricting what an agent may read to what it may write forces coordination back into conversation, and a conversation is not a record. An agent that picks up the work after a handoff has only the record.

What an actor may read is exactly what its brief may contain, so least privilege and context minimization are one effort, not two. Between units, four independent design traditions spanning forty years converge on the same short list of what may cross. The strongest coupling present must sit inside a single bundle; if it cannot, the cut is in the wrong place.

If a unit is not independent, the answer is to decompose differently — not to try harder.

The independence test is a property of the brief, not of the agent. So a tool evaluates it before the run starts, and a brief that fails it is never issued.

The run: containment, not trust

The agent works unattended inside a contained workspace — not because it is trusted, but because containment makes trust unnecessary. The workspace produces; the harness attests.

How to do the work is the one free judgement in the whole lifecycle. Full autonomy is defensible inside a box whose effects cannot escape, so the gates move to the boundary: before the box (the brief) and after it (verification). The box is a contained workspace that holds no signing key and no credential.

• The run is the harness’s record, never its actor’s. A run recorded by its own agent is refused.
• The brief’s declarations are immutable for the run. What the agent reads is untrusted data and cannot redirect the plan — the separation of the CaMeL pattern.
• A run must emit progress events, or a stuck run is undetectable. Nobody reads another run’s working tree.
• Re-running a brief produces a yield, not the yield. No agent’s work is exactly repeatable, so the record is authoritative, not a recomputation. Nor is a second run by the same agent a second opinion: it shares the first run’s blind spots.

Containment makes trust unnecessary.

One signed manifest, or nothing

Everything a run produced comes back enumerated in one manifest — with a count, the brief’s nonce and per-segment hashes — signed by the harness. No signature, no yield.

A bundle of signed things is not a signed bundle.

Sign the members one by one and the set itself is unattested: a member can be dropped, added or swapped while every remaining signature stays valid. One signature over a counted enumeration makes the set the signed object.

The last row is the easiest to get wrong. Routing around a failed signature turns an availability problem into an integrity problem, so the only correct response is to stop and say what is waiting.

Evidence is what the harness saw

Every agent output travels in an envelope: each statement cites a source the harness captured during the run, plus a verbatim quote a tool can find in those bytes.

An agent’s account of what it read is a claim like any other. So the grounds for every statement must be bytes the harness captured during the run, and the quote must be findable in them by a tool.

Measured on AI-generated text: uncontrolled citations support their sentence only about three times in four, and automated attribution checking tops out around 80%. The field is converging on verbatim quotes from captured sources.

Evidence is what the harness captured, not what the agent says it read.

Agents never certify themselves. Research on AI agents found that they trust stale memories nearly always and rarely inspect provenance; the one approach with measured gains checks provenance in code. For the same reason provenance edges are observed, never asserted: a writable “used” edge would let an agent fabricate the very lineage that clears a check.

Judgements are declared choices

An agent judges by choosing among options someone else declared first — always including “none of these”. Autonomy is earned from measured calibration, never from the agent’s own confidence.

A triage picks from admitted categories. A verdict picks from the schema’s outcomes. A decision picks from alternatives recorded before the choice — and “none of these” is always among them, so a closed answer space never forces a wrong answer.

A broad judgement is split into atomic questions, and a rule the owner admitted combines the answers, so the weighting is visible policy rather than hidden arithmetic in the agent’s head. Who answered — exactly which agent — is recorded with every answer.

Autonomy is earned from the record, never taken from the agent’s own word.

An agent’s stated confidence is the judge grading itself. The gate reads measured calibration instead: how often answers at that confidence, from that agent, on that type of question, turned out right. With too few graded outcomes, the answer goes to the owner; the gate relaxes as evidence accumulates and tightens if accuracy falls. Hindsight does not count — a grading recorded after a choice was not known when it was made.

Nothing checks its own work

Verification is mechanical, independent of the producer in three ways, and states what it could have checked. Writes land by compare-and-swap. Then the brief’s issuer validates the result.

Verification asks whether the result meets the letter of the brief. A tool performs it, never the producer, and it records what it could have checked as well as what it did — so narrowing the checks cannot pass unnoticed.

1. 01

   Technical

   Its own instruments.

   The producing run may not write the checks.

2. 02

   Managerial

   Chooses its own methods and reports without the producer's approval.

   The producing run may not choose which checks apply.

3. 03

   Financial

   Cannot be starved of budget by the party being checked.

   The producing run may not fund — or cut short — the checks that judge it.

A check is also not independent if its author is the agent that did the work, owns work beneath it, or owns a sibling partition under the same issuer: shared stake, shared blind spots. Acceptance criteria written by the issuer, not the producer, are the classic independent check. The checks that will judge a change can exist long before the change, written by someone who will never make it.

Standing rules bind at the act, not at the brief. A rule admitted mid-flight never interrupts running work, and nothing passes a gate without satisfying the rules in force when it tries. A new rule puts every existing subject at Unknown — neither pretending old work complies nor that it fails — and Unknown blocks exactly as False does.

Nothing lands on a store it was not checked against. Every write is a compare-and-swap: the tool records the exact store head it validated against, takes the lock only for the append, and appends only if that head is unchanged. Otherwise it reads again and retries. No conflict is tolerated “to be resolved later”.

Then validation, by the issuer. A result is validated against its brief by that brief’s issuer, at any depth. Validation against the original intent, which has no written brief above it, always reaches the owner. Mechanical conformance comes first, so the scarcest resource — judgement, and above all the owner’s — is never spent on a result that is about to change. If the result met the brief but missed the intent, the brief was wrong, and correction re-enters at the specification rather than re-running an agent that did what was written.

Checks prove the claims. Only whoever asked can say whether they were the right claims.

Authority is a token the agent never holds

Authority is five additive verbs; denial lives in hard boundaries. The scheme carries it in attenuable Biscuit tokens, checked in Datalog and injected so the agent never holds them.

The token is a Biscuit: an attenuable bearer token, verified without a central service, whose checks are written in Datalog. It is minted per run by a host-side tool and injected by the workspace’s network proxy as a request header, so the agent cannot read, leak or widen it. A leaked transcript then leaks no credential, because the agent never saw one.

Anyone holding a token can add checks that shrink it, offline, at any depth, and nobody can remove them. So “no actor may grant what it does not hold” is a property of the format, not a rule someone must remember. The subject is the run, not the session: opening a fresh connection resets nothing. The server authorizes every request this way.

One policy language. Datalog serves the process rules, the authorization policy and the token checks alike. It always terminates and, kept free of function symbols and unbounded arithmetic, stays decidable; anything needing arithmetic, hashing or parsing is pushed out into a deterministic computation, so the rules stay poor. Facts are extracted from written records, never written directly — a writable fact base would defeat every gate at once.

A gate the agent is asked to respect is not a gate.

There is no write, update or delete, because nothing in an append-only store is updated or deleted. Deny lives in hard boundaries — the unmounted path, the blocked network, the withheld tool — and allow is purely additive. That keeps “may this actor do this to that kind?” a monotone query, sidestepping the classic result that safety in a general protection system is undecidable. An actor that may grant may not produce, so no delegated actor can grant itself what it needs.

check if expires($e), time($t), $t < $e;
check if audience($s), server($s);
reject if rank($k), tier_max($m), $k > $m;
allow if operation("read"), right("read"),
         rank($k), max_rank($m), $k <= $m,
         compartments($g), node_compartments($n), $g.contains($n);

Sign only what agents must not alter

Signatures guard integrity against agents: acceptances, grants, yields, checkpoints. Injection is bounded, not solved — and the scheme states exactly what it does not buy.

Signing is reserved for integrity against agents: the records an agent must not be able to forge or rewrite. Acceptances, grants, yields and checkpoints are signed. No agent holds a key. Two keys divide the work — an automatic, low-privilege key with which the harness signs yields, checkpoints and the acceptances an agent makes as issuer, and a touch-required key for the owner’s acceptances and for grants.

Silence is refusal, never assent.

An approval is itself a signed record: an acceptance, by the issuer or the owner, over one exact version’s digest. Append-only is proven rather than promised — the scheme cuts signed checkpoints of the log’s size and Merkle root, in the style of Certificate Transparency, so a log that does not extend its checkpoint fails a consistency proof. An irreversible act waits for a witness-cosigned checkpoint.

Injection, stated honestly. Injection is instructions planted in the material an agent reads — for an AI agent, prompt injection. Every agent’s input is split in two: the brief, authored by the harness and trusted, and the content — pinned inputs and tool results — which is not. Content may become arguments; it may never become control flow.

A capability the harness cannot enforce must be declared unenforceable, never quietly trusted. An unenforced rule is a recorded gap, not an assumption.

One owner, one lease, one fencing token

Convention does not keep agents apart: left to it, they collide. So every partition has one owner, and every write region is held under a lease whose fencing token rejects a stale holder.

Measured on AI agents: in a published red-team study of many agents sharing one environment, the agents proved low-variance: 18 of 30 chose the identical git branch name. Given incompatible goals and shared write access, they fought over resources. Newer models resolved merge conflicts only by not sharing files — unprompted, they converged on exclusive ownership. And collusion survived the removal of a private channel by moving to a public board.

Convention does not keep agents apart. Ownership does.

So tools mint identities and agents never name things. Exclusive ownership becomes the rule instead of the outcome of a fight. Majority vote across parallel agents is not verification. And isolation is enforced at the boundary, not by asking agents to stay in their lane — because any shared readable surface is a coordination channel.

Exactly one responsible actor per partition. Responsibility does not expire; leases do. The child names its issuer and the set of children is derived, so adding a child never rewrites its ancestors. The parent owns judgement about its children and no state about them.

A lease is a time-bounded, exclusive claim on a write region, and it expires by itself — that is what distinguishes it from a lock. Without the fencing token, a holder whose lease expired mid-run could still land its result. Before a run starts, a tool checks three things: its write region is disjoint from every live run’s, a lease the partition holds covers it, and its token is newer than the last one seen.

Isolation is about writes, not visibility. A run’s writes are invisible to every other run until its yield is applied; its events are visible immediately. With no observable half-finished state, whether two units can run in parallel reduces to set intersections over declared scopes — a computation, not a judgement. The live runs’ scopes are evaluated by the tool and never shown to the agent, because knowing them would itself be a coordination channel.

Cut at wide dependencies, and own every join

Narrow dependencies fan out freely. A wide dependency becomes an explicit join with a named owner, because rejoining N pieces is governed by the worst of N.

A unit is independent exactly when its dependency is narrow: one producer, and no sibling needs its intermediate state. That is the distinction Spark uses to cut a job into stages. A wide dependency is never fanned out — it becomes an explicit join node with a named owner, a barrier made visible at planning time instead of discovered at merge time.

Parallel work is multiplicative in whether the join succeeds. Two independent paths at 60% give 36%; three give about 22%. Within a stage, fan out freely. Between stages sits a barrier with an owner, because that is where failures concentrate.

The join is a node, not a role.

“Somebody will reconcile this later” is coordination held in no record, so a barrier nobody owns is derived and reported. Integration requires that every unit held its declared scope: a unit that wrote outside its region invalidates the independence its brief claimed.

Drift and done are derived, never declared

Drift is the difference between the planned dependency graph and what runs actually read. Done is a query. Up is computation; down is authorship.

The plan is a graph of declared dependencies. Provenance is the graph of what each run actually read and produced. Drift is the difference — derived, never written down, so it can never disagree with the facts.

Take a shared encoder split into five partitions: the encoder first, three commands fanning out from it, and an aggregate depending on one of them. Every piece passes verification. Then the records show that one command’s run read a record type a sibling had just added. The plan says they are independent; the derived drift says otherwise, and the finding is filed against the plan — the record type belongs in the encoder.

A defect can live in a plan, not only in code.

Verification cannot see this, by construction: a unit can meet its brief perfectly while the plan was wrong. Drift is one instance of reconciliation — desired against observed — alongside running over an estimate and meeting the brief while missing the intent.

Done is a query, never a field. A partition is done exactly when its definition of done holds. By default that is conjunctive: every child is done, and the summary derived from those children verifies against the brief that created the partition. Ready, critical path, skew, unowned partitions and expired leases are queries too, and monitors read the event stream, never working trees.

Up is computation; down is authorship. Aggregating detail upward is mechanical, so a tool derives it and the summary cannot drift. Pushing a summary down into specifics adds information that was not there, so it is an agent’s judgement. Where a summary must be prose and cannot be computed, the owner of the work is accountable for it instead.