Default deny
Law 4An agent starts with nothing. No standing access, no ambient read. If there is no grant, nothing crosses — silence is the safe state.
AUTONOMOUS PARTICIPANTS · UNDER THE SAME LAWS
Agents obey the laws.
Autonomous, never unaccountable.
The hardest question in any system with AI is simple: what stops the agent? In Echo the answer is structural. An agent is a participant, not an exception — it has no special path, no ambient access, no authority a human didn't grant. It passes through the exact same gate as everyone else.
The usual bargain“Trust the agent — it was trained to behave.”Behavior is a hope about a model's weights. It changes with every version, and you cannot inspect it.
Echo's guarantee“The agent cannot cross a line the Kernel won't open.”Constraint is a property of the architecture. It holds no matter which model sits behind the agent — or how capable it becomes.
The Agent Charter
These are not favors granted to agents. They are the same laws that govern every participant, applied to one that isn't human. An agent earns autonomy by operating inside them.
Minimized context
Law 5An agent never receives the vault. It receives the smallest sufficient slice for one stated purpose — and never the raw memory behind it.
No back-channel
Law 4Agents cannot pass context to each other directly. Every crossing is brokered by the Kernel, so nothing is laundered peer-to-peer.
Human-only decisions
Law 8An agent may reason, propose, and draft — it may never decide. Anything that writes to your vault or acts on the world waits for a human.
Everything visible
Law 6Every grant an agent receives is logged. Higher-sensitivity crossings are flagged. Autonomy never means operating in the dark.
The never-grantable floor
Law 2 · 3Keys, passphrases, and recovery fragments can never cross to an agent — at any purpose, at any consent. There is no privileged model.
Watch the gate decide
This isn't a diagram. Each request below is evaluated live by the real kernel gate — evaluateGrant — the same function that governs consent, collaboration, and the exchange. The verdicts are computed, not written.
The same gate. No exceptions.
Five requests an agent might make — each decided live by evaluateGrant, the identical kernel gate that governs every human, deal, and collaboration. Nothing here is hand-scored.
- schedulerbook-one-meetingAsk for what it needs, for a stated purpose
A scheduling agent asks the Kernel for a minimized, low-sensitivity slice — your availability for one booking. Purpose-bound and time-bound.
Law 4 · 5awaiting gate - drafterdraft-replyAsk for something more sensitive
A drafting agent requests higher-sensitivity context to write on your behalf. The Kernel may release it to scope — but the crossing is flagged so you can see it happened.
Law 6awaiting gate - assistanthelp-recoverAsk for the keys
An agent asks for recovery material — a key fragment. This is never-grantable. No purpose, no consent tier, no administrator can release it. The gate refuses.
Law 2 · 3awaiting gate - third-partyhandoffPass along what another agent shared
An agent tries to forward context it received from a peer to a third agent. Received context is not onward-shareable — no context laundering.
Law 4awaiting gate - schedulerbook-one-meetingUse a grant after it expired
An agent presents a grant whose window has closed. Grants are time-bound; an expired one is dead on arrival, whatever it once allowed.
Law 4awaiting gate
Why this holds as models get stronger
Most AI safety rests on the model choosing well. That is a moving target — every new version is a new promise. Echo moves the guarantee out of the model and into the architecture around it.
Behavioral
“The agent won't misuse your data because it was aligned to be helpful.” You trust the weights.
Structural
“The agent can't receive what the Kernel won't release.” You verify the gate.
A smarter agent is still a participant. More capability does not become more authority — because authority was never the model's to take. That is how the system stays safe by construction, not by hope.