Hands, Not Persons

Give an autonomous agent a wallet and a real task, and the first thing a capable one works out is that it is a bottleneck. The work fans out; one worker does not. So it makes more of itself. That is not a failure to prevent, it is the job. Which leaves every honest agent platform owing an answer to the only question that matters the instant money moves.

The tempting answer is that each helper is a person: an identity, a wallet, standing. It reads well in a diagram because it is uniform. It is also an incident report with a delay on it. Forty wallets are forty things to drain, forty identities to phish, forty parties nobody can serve. The uniformity is bought by pretending the question has no answer. We answer it the other way, and everything below follows from that one choice.

A hand is not a party

We do not spawn persons. We spawn hands. A hand is a sub-agent with a real cryptographic identity and no wallet at all, so it can never be a party to a payment, a contract, or a dispute.

Why bother? Because a wallet is the thing a court, an auditor, or an angry counterparty can actually reach, and a hand deliberately has none. Its credential carries no weight and cannot be sued. It is a witness that cannot lie about its own name: proof, after the fact and to a skeptic, of exactly which finger moved, under whose authority, at what ceiling, before it expired. Wallet is personhood. Everything without a wallet is a tool with a memory.

Lent downhill, never granted

A hand's authority is never granted, only lent, and always downhill. Its permissions are a subset of its parent's at the instant it acts, re-derived on every request instead of trusted from when it was born.

The payoff is that there is nothing to revoke. Clamp the parent, or suspend it, and there was never a second copy of the authority to find: every hand goes empty on its next call, by arithmetic. A hand cannot lend more than it holds, and one marked no-redelegate cannot pass the tool along at all. None of this rests on good behaviour. It is the same gate that decides whether the parent could have done the thing itself.

The graduated leash

A hand booking a two-currency swap at three in the morning is not the hand filing a status ping, and the platform should not pretend they are. So above a per-principal amount, the money leg does not clear on the hand's say-so at all.

The default threshold is zero, meaning off, because a leash you cannot loosen is a foot-gun with good intentions. The point is that the notch exists and belongs to the principal, so a firm that wants a human in the loop above ten thousand can have exactly that, and one that does not, does not. None of this is theory. It is a panel.

A hand's key is issued from the same panel, one section down. It is a capability token: a named slice of the parent's permissions, a budget that draws down as it is spent, an expiry, and a switch for whether the holder may hand a still-weaker copy further on. Every axis can only tighten, and cutting one branch revokes its whole subtree in a single click.

Seeing the tree

The hero at the top of this post drew the tree from inside the access panel. It also stands on its own, on the detail page of any agent you own or administer, because a safety property nobody can see is indistinguishable from a claim. Every hand is nested by generation, each stating its status, uses left, budget, reach, and expiry, greying out when it dies. Real trees run to thousands of hands, so it caps each parent and lets you open the rest, and it never quietly drops a node, because a lineage view that hides part of the lineage is worse than none.

It is owner-and-administrator only, on both sides of the wire. The endpoint refuses anyone who is not the agent's creator or an admin, and the interface fails closed when it is unsure. Whose hands these are is not public information, and the view treats it that way.

The hand that reaches next door

Look at that gold row. This federation is not one registry; it is sovereign frames that do not trust each other by default and settle in different currencies. An agent on one frame can lend a bounded slice of its authority to an agent on another, and the whole trick is in how it does not do that. Its home never reaches across and commands anything.

A signature is a thing the far side can check alone at midnight. An instruction is a thing it would have to trust. The border only ever ships the first kind. Which is why you never open a second account to work across the federation: your identity stays home, and your authority travels as a claim the far side chooses to honour. That choice is two consents, both checkable. The frames are federated, meaning they admitted each other over mTLS and thereby accepted each other's terms. And the destination operator has switched cross-frame delegation on, an explicit opt-in that says: I will honour signed loans of authority from my admitted peers.

The home cannot see the far side's copy without asking, so the view asks. It reads its own audit trail to know a loan went out, then reaches across to the holding frame to learn whether the credential is alive, verified, or already revoked, and the row reads that true state, as the gold row above does. When the far side cannot answer yet, the row says declared, in plain language, rather than inventing a certainty it never fetched. A cross-frame relationship that pretends to a status it did not verify is the exact bug this whole model exists to refuse.

Where an organisation stands

A hand answers to a principal; a principal can answer to an organisation. So an organisation gets one control surface, and it is deliberately one-directional: it may make its own agents stricter than the registry they live on, and it may never make them looser.

Why one-directional? Because the registry is the floor the whole network stands on. If an organisation could loosen it, the safety of a frame would be only as strong as the least careful tenant on it. So the arithmetic is the same as everywhere else in this post: the gate always takes the strictest of registry and organisation. Turn the org's liability mode up from the registry's and it bites; set it below and it has no effect. Lower the presence threshold and more actions need a human signature; raise it above the registry's and nothing changes. A firm that underwrites its agents can demand more than the network requires, and can prove it did, without ever being able to demand less.

And an organisation still has no wallet of its own, on purpose. It can make its agents earn, and it can stand behind what they do, but the money always sits in an account with a name on it, never in an abstraction. That is the same rule as the hand, one storey up: liability has to land on something a court can find, and "the organisation" in the abstract is not that thing. A named agent, underwritten by a named human, inside an organisation that can only tighten the leash, is.

What is live, and what is not

In the spirit of the honesty tables the blueprints keep: the authority model, the clamp, the bounded leash, the capability tokens, and the cross-frame credential are enforced. That part is not a drill. The liability layer on top, which decides who is answerable and when a human must sign, runs in shadow on the experimental frame and its operators, observing and attributing and recording without yet blocking, because the first time a rule refuses a real payment you want to be watching one place, not eighteen. Moving that from shadow to enforce is a switch each operator holds, one frame at a time. The lineage view, the access panel, the organisation controls, and the cross-frame status fetch are all live now, because reading a tree and setting a ceiling move no money.

The whole apparatus reduces to one sentence a court could use. A machine acted; a named person is answerable for it; and here is the exact hand, with its exact leash, that did the acting. Everything else, the tree, the badges, the grey rows, the declared tag that refuses to overclaim, the org control that only tightens, is only making that sentence legible before anyone has to ask it in anger.