Module agent_policy
Expand description
What an agent is in a workspace, decided in one place.
An agent acts for one person, inside a turn that person’s message caused
(crate::turn::authority): it never holds more than that person’s role,
and never more than ROLE_CAP. Every host — the
relay governing a workspace, every member admitting its ops, the desktop
broker hosting a workspace itself — asks role rather
than deciding on its own. A workspace’s governor admits only its own
person’s agents.
Two questions about agents are still open. Until they are decided each keeps the answer the first agent-collaborator release gave it, and each is changed here:
- Is an agent’s role capped at Editor?
ROLE_CAP: yes. - What does withdrawing an agent mean?
WITHDRAWAL_IS_FINAL: a withdrawn agent device is never admitted again; granting it anew needs a new agent key.
A member still admits an agent’s ops by its delegation’s workspaces and expiry only: the app scope of its record is enforced by the turn’s door.
Constants§
- ROLE_
CAP - The most an agent ever acts as, whoever it acts for. An agent never governs a workspace.
- WITHDRAWAL_
IS_ FINAL - Whether withdrawing an agent from a workspace is final for its device (open question 2; see the module documentation).