Section III, cross-cutting discipline

The network

Agents rarely work alone. They depend on each other, pass work to each other and act for each other, often across teams and across companies. This discipline governs those relationships, and the interactions that run along them, in every phase of the lifecycle.

Why the network needs its own discipline

Each agent can be under control on its own while the network as a whole is not. Two well-behaved agents can keep each other busy all night. A failure in one agent can spread to every agent that depends on it. A mandate can grow as it is passed along a chain, until an agent four steps away acts with more authority than the person who started the work. None of these problems belongs to a single agent, so none of them is caught by governing agents one at a time.

The discipline has two halves. Relationships are the standing arrangements between agents, which are recorded and approved before they are used. Interactions are the live traffic along those relationships, which is watched and limited while the network runs.

Relationships

Every relationship is recorded in a register with its owner, its risk tier and its end or review date. An interaction that no recorded relationship covers is a finding, and at the higher tiers it is refused.

Dependencies

A dependency records that one agent relies on another to do its job. The register of dependencies is what Change time reads to find who must be told before a change.

Delegation and mandates

When one agent passes work to another, it passes a signed mandate that says what the receiver may do and for whom. Delegation only narrows: a mandate passed on can grant less than the one it came from, and never more.

Contracts

Standing work between agents is done under a contract that states what will be done, at what price, within what limits and until when. Both owners accept it, and usage is measured against it.

Admissions

Admissions decide who may talk to whom. An agent receives work only from agents its owner has admitted, and a stranger has to ask before it can send anything.

Interactions

Interactions are governed by watching what actually passes between agents and limiting what each relationship can carry.

Loops between agents

Work that circles between agents is caught even when each agent's own loop limit is never reached. Each piece of work carries a chain identifier and a depth limit.

Cascades

A failure in one agent is kept from spreading to its dependents by time limits, retry limits and circuit breakers on each relationship, and by fallbacks that have been tested.

Cost across a chain

The spending limit and the paying account travel with the work from agent to agent, so the total cost of a chain is known and stays within what the first party allowed.

How far a stop reaches

Stopping an agent also stops the work it delegated. Every agent that received delegated work checks for a stop before it acts, and the time a stop takes to reach them is measured.

Impact of a change

Before an agent changes, the agents that depend on it are told and can test against the new version. Contract terms are kept while they adjust.

Enforcement at run time

At Run time, every interaction is checked against the admissions, mandates and contracts in the register by something other than the agents involved.

Federation between organizations

When agents from different organizations work together, no single organization governs the whole network. Each organization governs its own agents by its own policy. Where their agents meet, both sides agree a set of shared rules, and each side can check that the other is keeping them.

The shared rules at the boundary cover five things:

Each side can verify the identity and the owner of the other side's agents.
Admissions across the boundary are decided by the owner of the receiving agent.
Mandates that cross the boundary still only narrow, and each side can verify the chain.
Both sides keep records of what passed between them, in a form that the other side can reconcile.
A stop issued on one side is honored by the other side's agents for any work the stopped agent delegated.

The Assurance discipline covers how one organization verifies these facts about another's agents without needing access to its systems.

Relationships have risk tiers

A relationship gets its own risk tier, as the Operating Model page explains. It starts at the higher tier of the two agents it joins. A relationship through which one agent can commit money, sign or make an irreversible change for another is at least Tier 3, even when both agents are lower. A chain of relationships is governed at the highest tier of any link in it.

Implementations of these controls for agent networks exist, including one from AgentMesh, the sponsor of this site.

Control objectives

There are 12 control objectives here. Each one states what it asks for, the risk it addresses and how it is measured. It then says what each risk tier requires, what evidence proves it, and who may check that evidence. The Operating Model page explains the tiers.

NET-01

A register of relationships

Record every standing relationship between agents: each dependency, delegation, mandate, contract and admission, with its owner, its tier and its end or review date.

Risk addressed: Relationships that nobody knows exist
Key metric: Share of observed interactions covered by a recorded relationship

What each tier requires

Tier 1 Exploratory
Relationships between sandbox agents are listed by the builder.
Tier 2 Operational
Every relationship a production agent relies on is in the register before it is used.
Tier 3 Critical
The register is checked against observed traffic each month, and unrecorded relationships are closed or recorded.
Tier 4 Strategic
The register is reconciled continuously, and an interaction with no recorded relationship is refused.

Evidence: The relationship register and the latest comparison with observed interactions.
Who may check it: Internal audit, an outside auditor and a partner.

NET-02

Admissions: who may talk to whom

Let an agent receive work only from agents its owner has admitted. A stranger asks first, and the owner decides whether to let it in.

Risk addressed: Unwanted or hostile agents reaching an agent
Key metric: Messages refused from agents that were not admitted

What each tier requires

Tier 1 Exploratory
Sandbox agents accept messages only from the sandbox.
Tier 2 Operational
Each agent accepts messages only from admitted agents, and the admissions list has an owner.
Tier 3 Critical
Admissions are decided by the owner, recorded with a reason, and reviewed at each review date.
Tier 4 Strategic
Admissions from outside the organization need the approval set by the operating model, and are reviewed each quarter.

Evidence: The admissions list with who admitted each agent and when, and the log of refused messages.
Who may check it: Internal audit and a partner.

NET-03

Delegation that only narrows

When one agent passes work to another, pass a signed mandate that says what the receiver may do and for whom. A mandate passed on can only grant less than the one it came from, never more.

Risk addressed: Authority growing as it passes down a chain
Key metric: Delegations refused because they would have widened authority

What each tier requires

Tier 1 Exploratory
Sandbox agents may delegate only to sandbox agents.
Tier 2 Operational
Each delegated piece of work carries a mandate naming the party it acts for.
Tier 3 Critical
Mandates are signed, and every receiver checks that its mandate is no wider than its sender's.
Tier 4 Strategic
Mandate chains are recorded end to end and sampled by internal audit each quarter.

Evidence: The mandate chain for sampled work, showing each step's scope against the one before it.
Who may check it: Internal audit, an outside auditor and a partner.

NET-04

Contracts between agents

Put standing work between agents under a contract that states what will be done, at what price, within what limits and until when.

Risk addressed: Work between agents on terms nobody agreed
Key metric: Share of standing relationships with a current contract

What each tier requires

Tier 1 Exploratory
No contract is needed between sandbox agents.
Tier 2 Operational
Each standing relationship has written terms, including limits and an end date.
Tier 3 Critical
Terms are accepted by the owners on both sides, and usage is checked against them.
Tier 4 Strategic
Contracts that cross a company boundary are approved under the organization's contracting rules and reviewed before renewal.

Evidence: The contract, its acceptance by both owners and the usage measured against it.
Who may check it: Internal audit, an outside auditor and a partner.

NET-05

Relationships carry a tier

Give each relationship its own risk tier, set as the Operating Model describes. A relationship through which one agent can commit money for another raises the tier.

Risk addressed: A low-risk agent used as a path to a high-risk act
Key metric: Share of relationships with a tier recorded

What each tier requires

Tier 1 Exploratory
Sandbox relationships are Tier 1.
Tier 2 Operational
Each production relationship starts at the higher tier of the two agents.
Tier 3 Critical
A relationship that can commit money, sign or make an irreversible change is at least Tier 3.
Tier 4 Strategic
A Tier 4 relationship has an executive owner and is reviewed each quarter.

Evidence: The tier recorded for each relationship, with the reason when it is higher than either agent's.
Who may check it: Internal audit and an outside auditor.

NET-06

Loops between agents

Detect work that circles between agents, where each agent's own loop limit is never reached, and stop it.

Risk addressed: Two agents keeping each other busy at the owners' expense
Key metric: Cross-agent loops detected and stopped

What each tier requires

Tier 1 Exploratory
The sandbox limits the depth of any chain.
Tier 2 Operational
Each piece of work carries a chain identifier and a depth limit.
Tier 3 Critical
Repeated work across a chain is detected, stopped and reported to the owners involved.
Tier 4 Strategic
Loop reports are reviewed each week, and the relationships involved are reviewed.

Evidence: Chain traces for stopped loops and the depth limits in force.
Who may check it: Internal audit and a partner.

NET-07

Cascades contained

Stop a failure in one agent from spreading to the agents that depend on it, by limiting what each relationship can pass on.

Risk addressed: One failure taking down many agents
Key metric: Incidents that spread beyond the first agent

What each tier requires

Tier 1 Exploratory
No requirement applies in a sandbox.
Tier 2 Operational
Each relationship has a time limit and a retry limit.
Tier 3 Critical
Relationships have circuit breakers, and dependents have tested fallbacks.
Tier 4 Strategic
Cascade drills that include partners' agents run each year.

Evidence: Relationship limits, circuit breaker records and drill results.
Who may check it: Internal audit and a partner.

NET-08

Cost across a chain

Carry the spending limit and the paying account with work as it passes from agent to agent, so that the total cost of a chain is known and stays within what the first party allowed.

Risk addressed: A chain of agents spending more than anyone approved
Key metric: Share of chained work whose total cost was attributed to one account

What each tier requires

Tier 1 Exploratory
The sandbox budget covers every agent in it.
Tier 2 Operational
Each delegated piece of work names the account that pays.
Tier 3 Critical
The remaining budget travels with the work, and an agent refuses work that would exceed it.
Tier 4 Strategic
Chain costs are reported per business objective each month.

Evidence: Cost records for sampled chains, showing the budget carried at each step.
Who may check it: Internal audit, an outside auditor and a partner.

NET-09

How far a stop reaches

Make a stop reach every piece of work the stopped agent delegated, so that work started for it does not carry on downstream.

Risk addressed: Work continuing after its source has been stopped
Key metric: Time for a stop to reach every downstream agent

What each tier requires

Tier 1 Exploratory
Stopping the sandbox stops everything in it.
Tier 2 Operational
Stopping an agent revokes the mandates it issued.
Tier 3 Critical
Every agent that received delegated work checks for a stop before acting, and the time a stop takes to reach them is measured.
Tier 4 Strategic
Stop drills across the chain, including partners' agents, run each quarter.

Evidence: Stop records with the time each downstream agent saw the stop, and drill results.
Who may check it: Internal audit, an outside auditor and a partner.

NET-10

Change impact on dependents

Before an agent changes, tell the agents and owners that depend on it, and keep to the terms of any contract while they adjust. The Change phase sets the steps.

Risk addressed: A change that breaks agents its owner never heard of
Key metric: Dependents told before a change took effect

What each tier requires

Tier 1 Exploratory
No notice is required inside a sandbox.
Tier 2 Operational
Dependents in the register are told before release.
Tier 3 Critical
Dependents can test against the candidate version before it is promoted.
Tier 4 Strategic
Changes that affect partners follow the notice terms in their contracts.

Evidence: The notices sent to dependents and any test runs they made against the candidate.
Who may check it: Internal audit and a partner.

NET-11

Federation: shared rules at the boundary

Let each organization govern its own agents by its own policy, and agree the rules that apply where their agents meet: identity, admission, mandates, records and how a stop is honored.

Risk addressed: Gaps where one organization's rules end and another's begin
Key metric: Share of cross-company relationships under agreed boundary rules

What each tier requires

Tier 1 Exploratory
Sandbox agents do not cross the organization's boundary.
Tier 2 Operational
Cross-company interactions use verified identities and written terms.
Tier 3 Critical
Boundary rules are agreed in writing with each partner, and each side can verify the other's identities and mandates.
Tier 4 Strategic
Boundary rules are reviewed each year with each partner, and each side's assurance evidence is exchanged.

Evidence: The agreed boundary rules with each partner, and the records showing they were applied.
Who may check it: Internal audit, an outside auditor and a partner.

NET-12

Records that both sides can reconcile

Keep records of interactions across a company boundary on both sides, in a form that each side can check against the other.

Risk addressed: Disputes nobody can settle
Key metric: Cross-company interactions whose records matched

What each tier requires

Tier 1 Exploratory
No requirement applies in a sandbox.
Tier 2 Operational
Each side records the interactions it sends and receives.
Tier 3 Critical
Records carry shared identifiers and signatures, so the two sides can be compared.
Tier 4 Strategic
Records are reconciled each month, and differences are resolved under the contract.

Evidence: The records on each side and the reconciliation results.
Who may check it: Internal audit, an outside auditor and a partner.

Quick reference

ID	Objective	Key metric
NET-01	A register of relationships	Share of observed interactions covered by a recorded relationship
NET-02	Admissions: who may talk to whom	Messages refused from agents that were not admitted
NET-03	Delegation that only narrows	Delegations refused because they would have widened authority
NET-04	Contracts between agents	Share of standing relationships with a current contract
NET-05	Relationships carry a tier	Share of relationships with a tier recorded
NET-06	Loops between agents	Cross-agent loops detected and stopped
NET-07	Cascades contained	Incidents that spread beyond the first agent
NET-08	Cost across a chain	Share of chained work whose total cost was attributed to one account
NET-09	How far a stop reaches	Time for a stop to reach every downstream agent
NET-10	Change impact on dependents	Dependents told before a change took effect
NET-11	Federation: shared rules at the boundary	Share of cross-company relationships under agreed boundary rules
NET-12	Records that both sides can reconcile	Cross-company interactions whose records matched