Requirements
- A written declaration states what the agent is, and a person reviews it before anything runs.
- The system refuses the declaration until every item it names exists under that name: its model, its tools, and its credentials. A missing item fails at review, not mid-run.
- Each session runs on its own instance, made from that declaration.
- Each instance has its own isolated environment, its own credentials, and its own record of what it did.
- Spending limits, the audit record, revocation, and containment apply to one instance, and not to something that serves many sessions.
- Ending an instance ends the access it held, and it leaves the other instances running.
Security considerations
Assume the model follows attacker instructions for the whole of one session. The attacker then controls what the agent asks for. The attacker does not control the declaration the instance was made from, or the limits attached to that instance. Spending limits, the audit record, revocation, and containment therefore survive, because the instance cannot change them. A system that asks the agent to respect its own limits has no such boundary, and the attacker inherits the enforcement along with the agent.
Residual risk: These properties bound one instance, so an attacker who can change the declaration changes every instance made from it afterwards.
Non-qualifying systems
Commonly substituted components: a configuration file that lists a prompt and some tools, or a conversation kept as a row in a table. Any of the following disqualifies a system:
- A declaration exists, and the agent starts even when the model, tools, or credentials it runs with differ from the declaration.
- Ending one session leaves its credentials usable, or it ends every other session too.
- Spending limits, the audit record, and credentials belong to the service as a whole. They do not belong to one session.