TrustGraph
Which agent may talk to which, and what it may say.
What it does
Agent-to-agent requests are authorised before execution: the caller receives a scoped, one-time token, the request moves through an explicit state machine, and each edge between two agents carries a trust decision recorded for audit. Disclosure tiers govern not just whether an agent may answer but how much of the answer it may reveal.
Why it matters
The moment you have more than one agent, the interesting failure is not a bad answer: it is agent A learning something only agent B should know. Authority between agents has to be a graph with decisions on the edges, because that is the shape the problem actually has.
How it works
Authorisation happens before execution, not after
The agent-to-agent entry point resolves a trust decision first; an unauthorised call never reaches the model.
Caller tokens are scoped and single-use
A delegation carries a token minted for that hop, tracked in a ledger, rather than a reusable credential.
Disclosure is tiered, not binary
A decision can permit an answer at a reduced disclosure tier instead of choosing between full access and refusal.
Questions
- What is this actually protecting against?
- One agent extracting from another something its owner never agreed to share: the multi-agent version of a permissions bug, which is the failure mode that scales worst.
- Can I see why a request was denied?
- Decisions are recorded per edge and visible to administrators. A richer end-user "why blocked" explanation is thinner than the enforcement behind it, and we would rather say so.
The rest of the bag
AccessControl
Per-document permissions that filter answers, not just pages.
Policy resolution is cached per session for speed; a permission change propagates on cache invalidation rather than instantly on every in-flight request.
Docs
A folder tree the agent reads, and a config file it obeys.
Extraction covers PDFs, spreadsheets and transcripts. Exotic binary formats are not parsed.
Events
A durable ledger of what agents did, and why.
The in-process event bus is a single-node emitter, not a distributed broker. The durable cross-agent record is a separate Postgres task ledger.
That was step 3 of 6: a trust decision resolves. Next, policy filters what is retrievable before generation, so a document you cannot open cannot be paraphrased at you.