Why this is hard
An app does the same thing every time it runs. An agent is given a goal and a set of tools, and decides at runtime what to call, in what order. A review at go-live cannot know everything an agent will do. An agent that reads an email or a supplier’s document can also be told, by that content, to do something else.
What Substrait does
An agent is a tool its builder owns. It is registered, deployed and governed like any other tool on Substrait.
Its own identity, never borrowed. Each agent gets an identity that Substrait issues, scopes and can revoke. It never acts on a person’s standing credentials.
Narrower than its owner. An agent’s authority is the smaller of two things: what its owner may reach, and what the agent was granted. Everything else is denied.
A check on every action. Substrait checks each action against the agent’s limits at the moment it happens. Calls to company data go through Substrait’s gateway, under the agent’s own grant.
A record of who it acted for. Every action is recorded as “this agent, acting for this person”. One accountable person stands behind every action.
A switch on the identity. Switching off an agent’s identity stops it at once, wherever it runs.
People decide what agents should not. When an agent needs a human decision, it asks through Substrait’s communications centre, and the right person answers from their own channel.