mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
72 lines
3.2 KiB
TeX
72 lines
3.2 KiB
TeX
\section{Agent Capsules}
|
|
\label{sec:agents}
|
|
% ============================================================================
|
|
|
|
AI agents are first-class principals in the Capsule model. An agent gets its
|
|
own capsule with its own vault, identity, capabilities, and audit chain.
|
|
This is not a metaphor. An agent capsule has the same formal structure as a
|
|
human capsule.
|
|
|
|
\subsection{Agent as Sovereign Process}
|
|
|
|
\begin{definition}[Agent Capsule]\label{def:agent}
|
|
An \textbf{agent capsule} is a capsule $\mathcal{C}_a$ where the principal is
|
|
an autonomous software process. The agent's vault stores its memory (conversation
|
|
history, learned preferences, tool outputs), its capability set $\Gamma_a$
|
|
defines what APIs, data sources, and actions it may access, and its key policy
|
|
$\mathcal{P}_a$ defines who can inspect, modify, or terminate the agent.
|
|
\end{definition}
|
|
|
|
Key differences from human capsules:
|
|
|
|
\begin{itemize}[nosep]
|
|
\item \textbf{Delegated authority}: An agent's root key is typically generated
|
|
by a human principal and delegated via $\Gamma$ with explicit scope
|
|
and time bounds. The agent cannot escalate its own capabilities.
|
|
\item \textbf{Budget constraints}: $\mathcal{P}_a$ includes spending limits---
|
|
maximum LUX per transaction, per day, and per provider interaction.
|
|
Exceeded budgets halt the agent until the delegating principal
|
|
re-authorizes.
|
|
\item \textbf{Auditable memory}: Every write to the agent's vault is signed
|
|
and anchored. A human principal can audit the complete history of what
|
|
the agent stored, when, and in response to what input.
|
|
\item \textbf{Private inference}: For Class III agent operations, inference
|
|
runs on encrypted data via FHE or inside a TEE. The compute provider
|
|
sees neither the model weights nor the user's input.
|
|
\end{itemize}
|
|
|
|
\subsection{Agent Capability Model}
|
|
|
|
Agent capabilities are structured as a DAG of UCAN tokens:
|
|
|
|
\begin{verbatim}
|
|
human-root
|
|
|-- agent-root (time-bounded, budget-limited)
|
|
|-- read:vault/user-preferences
|
|
|-- write:vault/agent-memory
|
|
|-- call:api/weather (rate-limited)
|
|
|-- call:api/calendar (read-only)
|
|
+-- spend:lux/0.1-per-tx
|
|
\end{verbatim}
|
|
|
|
Each capability token is a signed JWT with fields: \texttt{iss} (delegator DID),
|
|
\texttt{aud} (agent DID), \texttt{att} (resource + action), \texttt{exp}
|
|
(expiration), \texttt{prf} (proof chain back to root). Revocation is a K-Chain
|
|
transaction.
|
|
|
|
\subsection{Agent Lifecycle}
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Spawn}: Human principal creates agent capsule, generates agent
|
|
keys, delegates capabilities, sets budget.
|
|
\item \textbf{Execute}: Agent reads from its vault, invokes tools within
|
|
$\Gamma_a$, writes results to its vault, anchors receipts.
|
|
\item \textbf{Inspect}: Human principal reads agent vault (using delegated
|
|
read capability on $\mathcal{C}_a$) to review memory and actions.
|
|
\item \textbf{Revoke}: Human principal revokes $\Gamma_a$ on K-Chain.
|
|
Agent can no longer invoke tools or write to its vault. Vault contents
|
|
remain readable for audit.
|
|
\end{enumerate}
|
|
|
|
% ============================================================================
|