From cb4c18cedcf04a710c68114dcaa54482e8c9afcd Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 16 Oct 2026 02:45:58 +0200 Subject: [PATCH] Design 58: the identity store is read by grant, and sessions never call through the tool runner's login (review round 1) --- 03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md b/03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md index 84af84f3..cfae3781 100644 --- a/03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md +++ b/03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md @@ -93,7 +93,8 @@ owns it. Claude Code's own built-in tools, its command tool included, are turned The identity seat, held once for the mesh, owns every **identity** (a person, an agent or a module) and every **role**, in the bus's key-value store. An identity has a name, a kind, a role and whether it is switched on. They -change only through the seat's verbs, each recorded with who asked; anything may watch the store live. Only the +change only through the seat's verbs, each recorded with who asked; a module or front end whose role grants the +seat's reads may watch the store live, and it holds no secret. Only the operator creates a person or an agent, or changes its role. A module's identity is asked for by the controller when the module is assigned to a node, named by machine and module, with a role made from what its manifest declares it calls. @@ -102,7 +103,8 @@ A role holds **grants**. A grant is an effect everywhere, an effect on one seat, limited to named machines. Two fences check them: the bus, coarsely, by seat and module, from the role's signing key; and the tool runner, exactly, tool by tool, in the SDK. Every call carries its thread; a module acting for an agent carries a token the identity seat signed for that agent, and the tool runner then checks the agent's role. A -refusal names the missing grant; every call is recorded with its identity and thread. +refusal names the missing grant; every call is recorded with its identity and thread. A session on an operator's +machine calls as the operator's person identity or as an agent, never through the machine's tool-runner login. ## 6. Effects, asks and break-glass (ADR 0387)