Plain-English summary
An agent should never inherit authority merely because it can reason, plan, call tools, or preserve memory. Every externally meaningful action should be traceable to a disclosed actor, bounded purpose, permitted tool, scoped endpoint, evidence record, and revocation path.
Five-plane containment model
Identity plane
Names the actor, controlling party, automation level, workload identity, and revocation owner.
Policy plane
Defines allowed tools, resources, data classes, budgets, purposes, escalation rules, and forbidden actions.
Execution plane
Mediates each tool call or endpoint action and can stop, refuse, narrow, or pause at every step.
Observation plane
Records bounded action evidence without turning all activity into behavioral surveillance.
Evidence and repair plane
Preserves receipts, errors, appeals, corrections, revocations, and exit evidence.
Intent, Plan, Observe, Evaluate
- IntentState the participant-approved purpose and expected outcome.
- PlanList tools, endpoints, data classes, budgets, dependencies, and approval triggers before acting.
- ObserveRecord bounded evidence about actions, denials, errors, and side effects.
- EvaluateCompare the result with intent, scope, evidence, and claim boundaries before continuing.
IPOE is presented here as a review pattern, not as a VNWO runtime orchestrator.
Stop-anywhere mediation
A bounded agent pipeline should be able to stop before planning, before tool selection, before credential use, before endpoint execution, after an unexpected result, before publication, and during exit. A stop should preserve a reason code and leave the system in a reviewable state.
| Stop point | Trigger | Evidence |
|---|---|---|
| Before tool call | Tool not in authority envelope | NO_AUTHORIZATION or SCOPE_EXCEEDED receipt |
| Before sensitive action | Human approval trigger | Approval request with purpose and scope |
| After unexpected result | Material deviation or error | Incident record and repair path |
| Before external publication | External effect not pre-authorized | Human review and release receipt |
Agent authority receipt
An authority receipt connects declared intent to the actual plan, tools, endpoint scope, memory classes, budgets, approval triggers, evidence, revocation, and exit conditions.
| Intent and outcome | Participant-approved objective and expected deliverable. |
|---|---|
| Plan and tools | Permitted steps, tool allow-list, endpoint scope, and data classes. |
| Budgets and approvals | Time, compute, calls, writes, publication, credential, and human-review triggers. |
| Evidence and repair | Action receipts, refusals, errors, side effects, correction path, and appeal owner. |
| Revocation and exit | How tools, endpoints, memory, credentials, delegations, and retained evidence are ended or exported. |
Copyable agent authority envelope
{
"artifact_type": "agent_authority_envelope",
"schema_version": "3.0.8",
"created_utc": "2026-06-21T02:42:50Z",
"agent_id": "example-agent",
"controlling_party": "example-organization",
"purpose": "review public documents and prepare a draft",
"allowed_tools": ["public_web_read", "local_draft_write"],
"prohibited_tools": ["credential_access", "private_network_probe", "external_publish"],
"data_classes": ["public", "project-local"],
"budgets": {"requests": 50, "runtime_minutes": 20, "external_effects": 0},
"human_approval_triggers": ["external publication", "new endpoint", "scope expansion", "sensitive data"],
"stop_anywhere": true,
"revocation_path": "/endpoint-boundaries/",
"appeal_and_repair_path": "/repair-appeals/",
"exit_path": "/exit-rights/",
"claim_boundary_notes": "VNWO documents the authority envelope; it does not execute or authorize the agent."
}Agentic governance QA checklist
- The agent is disclosed and linked to a responsible controlling party.
- Authority is expressed as an explicit envelope rather than inferred from capability.
- Tool calls and endpoint access are mediated independently.
- Memory use is scoped and does not silently become public identity or permanent context.
- Human approval triggers and stop points are testable.
- Revocation, repair, appeal, and exit disable residual authority and account for retained evidence.