One gives humans, scripts, CI, operators, and AI agents different interfaces to the same typed operations. No interface gains a hidden control plane.
Fix context before capability
Every automation session starts with an exact workspace or subject scope, selected roots, policy, identity, tool set, resource budget, and provider bindings. Context construction is inspectable and bounded.
Reading a file, receiving a prompt, or seeing a credential reference does not grant authority to disclose, mutate, execute, deploy, or use the referenced secret. Each action is authorized independently.
Use operations, not command text
Automation consumes versioned requests and results for source reads and transactions, search, check, test, invoke, plan, Build, apply, cancellation, and inspection. A terminal command may project the same operation for a person, but machine callers do not scrape human output or acquire a shell bypass.
The protocol preserves owner-qualified identities, typed failures, progress, approval suspension, resumability, and evidence links.
Separate proposal from effect
An agent can draft source patches, explain plans, compare providers, propose an operation, or prepare an approval request. The owning parser and systems still validate the exact result. A write uses a revision-checked source transaction. An effect uses a reviewed plan and fresh grant.
Approvals display the actual action, subject, scope, data disclosure, provider, cost, expiry, and blast radius. Approval of a summary does not authorize later different arguments.
Make autonomy bounded and resumable
Long work retains deterministic agent and tool events, resource consumption, child tasks, approvals, cancellation, and terminal disposition. A suspended task resumes from exact retained state rather than reconstructing authority from conversation text.
Delegated child work receives an attenuated subset of workspace, tools, budgets, and grants. It cannot further delegate unless explicitly permitted.
Govern models as providers
Model selection is independent from the agent operation contract. A model provider profile states data handling, retention, region, price, context and output limits, tool-call behavior, identity, availability, and evidence.
Sensitive prompts can require local inference, redaction, confidential execution, or explicit disclosure approval. Model quality observations inform selection but never become authority.
Example
An illustrative approval request binds the exact proposed effect:
{
"operation": "parcelhub.refunds#Approve@1",
"subject": "refund/order-7391",
"amount_minor": 4200,
"expires_in": "5m"
}See authority and trust and product guarantees, then follow the bounded agent recipe.