Design principles
Eight theses guide every trade-off in Agent NAS; seven bets say what it is wagering on and what happens if the wager is wrong. A design that hopes to hold for years should say when it will be wrong.
1. The unit of access is the run, not the account
The current practice is to give an agent a long-lived token or a human account: the token in the April 2026 incident was “made for managing domains, yet could do anything”. A run has a start, an end, a purpose and a responsible party, which makes it a natural unit of authorization and accountability.
Rules out: shared keys, long-lived tokens and borrowed human accounts.
2. Undo is cheaper than prevention
Prevention (approvals, classifiers, rules in prompts) will always leak: classifiers miss things, people are worse, and models break principles written into their prompts. Making mistakes undoable (branches, soft delete, snapshots) is much easier than making every action correct, and easier to verify. A corollary: the recovery path must lie outside the blast radius of what it protects, so snapshots are held by the owner and are outside the power of any lease.
Rules out: treating “a line in the prompt asking for confirmation” as a control.
3. Authority is lent per task, not granted per identity
A run receives a narrow, time-limited lease with budgets; long-lived keys stay with the orchestrator or the owner, and the model never sees them.
Rules out: long-lived, broad, standing permissions.
4. Notes are truth, intelligence is cache
Memory should be files people can read and edit; indexes, embeddings and summaries are disposable, rebuildable derivatives. That way the retrieval algorithm can change without losing memory, and poisoning and deletion become tractable.
Rules out: opaque memory stores that cannot be inspected or moved.
5. Provenance is the spine
Every memory, every derivative and every merge can answer “where did it come from, and what influenced it?”. Provenance is the basis of audit and also of poisoning control, trust labels and forgetting.
Rules out: memory without provenance.
6. Policy is deterministic, and models can only tighten
Authorization decisions are made by code, not by a model’s “opinion”. A classifier or an LLM may suggest that “this step needs approval”, but can never approve.
Rules out: letting a model decide for itself whether something may go through.
7. Keep storage boring, put innovation in the contract
No new engine; files first, because the interface models know best is the file; protocols will change, the six nouns will not.
Rules out: inventing a new storage engine in the name of AI.
8. What is scarce is tokens and human attention
Reads get a budget; approvals are few and specific, and sit where a person can really judge: at plans and merges, not at every action.
Rules out: returning whole files by default; a pop-up for every action.
Seven bets and what would refute them
A design that hopes to hold for years should say what it bets on and when it would be wrong.
| Bet | Basis | If wrong |
|---|---|---|
| B1 Agents will keep using the file system and Git as their main working medium | Several mainstream runtimes have already moved to files. | If they move to dedicated “memory APIs”, Agent Home degrades into an export format; the other concepts do not depend on files and still stand. |
| B2 “A run” remains the natural unit of authorization and accountability | Orchestrators generally start sandboxes per task or per session. | If long-lived autonomous processes appear, leases become rolling renewals with budgets, and the concept stays. |
| B3 Prompt injection will not be eradicated at the model layer in the foreseeable future | Meta’s own wording; classifier miss rates; several attack studies. | If it is eradicated, Trust Labels become one cheap layer of defence in depth. |
| B4 Human attention remains scarce | Data disclosed by Anthropic. | If full automation becomes reliable enough, a Human Gate gives way to pre-authorizing policy, and the audit stays. |
| B5 The storage layer is the right place to enforce provenance and taint | Memory-security research stresses provenance at write time; OpenClaw did the same inside one runtime. | If every runtime does it well itself, the NAS only needs to store labels, and its role gets thinner. |
| B6 Memory shared across runtimes and agents will become a real need | Multi-agent collaboration; the cost of migrating frameworks. | If memory stays a private feature of each framework, Agent Memory’s value lies mainly in portability for individuals and small teams. |
| B7 Protocols will change, but “files plus tools” as two ports will stay stable | MCP version migrations; A2A 1.0. | Swap the adapters; this is why adapters isolate the protocols. |
What we expect to stay stable, and what to change
| Expected to stay stable | Expected to change |
|---|---|
| The six nouns | Specific protocols and transports |
| The directory convention of a Home | Embedding models and retrieval algorithms |
| The four promises | Token formats |
| The guarantee of “export means exit” | Agent frameworks and human-computer interfaces |
Cite this page
Stable addresses and a suggested citation for people, search engines and agents.
- Canonical URL
- https://agentnas.com/principles/
- Markdown version
- https://agentnas.com/principles/index.md
- Suggested citation
- Agent NAS project. “Design principles.” agentnas.com, 2026-11-11. https://agentnas.com/principles/