TrustGraph
Which agent may talk to which, and what it may say.
What it does
Agent-to-agent requests are authorised before execution: the caller receives a scoped, one-time token, the request moves through an explicit state machine, and each edge between two agents carries a trust decision recorded for audit. Disclosure tiers govern not just whether an agent may answer but how much of the answer it may reveal.
Why it matters
The moment you have more than one agent, the interesting failure is not a bad answer: it is agent A learning something only agent B should know. Authority between agents has to be a graph with decisions on the edges, because that is the shape the problem actually has.
How it works
Authorisation happens before execution, not after
The agent-to-agent entry point resolves a trust decision first; an unauthorised call never reaches the model.
Caller tokens are scoped and single-use
A delegation carries a token minted for that hop, tracked in a ledger, rather than a reusable credential.
Disclosure is tiered, not binary
A decision can permit an answer at a reduced disclosure tier instead of choosing between full access and refusal.
Questions
- What is this actually protecting against?
- One agent extracting from another something its owner never agreed to share: the multi-agent version of a permissions bug, which is the failure mode that scales worst.
- Can I see why a request was denied?
- Decisions are recorded per edge and visible to administrators. A richer end-user "why blocked" explanation is thinner than the enforcement behind it, and we would rather say so.
The rest of the bag
Your agent has its own inbox, not a share of yours.
Inbound arrives by webhook from an email provider. We do not run our own MX or SMTP servers.
Package
Export, share and install agents as portable archives.
Export, import, handoff links and showcase all work. There is no marketplace, no package versioning, and no signed packages.
Memory
Grounded retrieval over your own material, with receipts.
This is retrieval, not persistent agent memory. Vector grounding is code-complete; the vector deployment is still pending.
That was step 3 of 6: a trust decision resolves. Next, policy filters what is retrievable before generation, so a document you cannot open cannot be paraphrased at you.