LAWS 4 · 5 · 6 · 7 · 8The Kernel decides what crosses — including between one agent and another. Agents advise; the human decides.read the laws →
ECHO MULTI-AGENT LAYER · CONSENT MODEL v0.2 · LOCKED

Agents may debate. Memory never travels by assumption.

The governed collaboration layer where multiple agents can reason together — but only through Kernel-approved, minimized, auditable context. This is a separation of powers: reasoning belongs to the agents, knowledge to the Kernel, action to the human. If an agent can act without the human, or know without the Kernel, the model is broken.

Asymmetric SafetyWhen uncertain, Echo may raise protection automatically — never lower it — and the auto-raise is still logged. An agent may say “protect this more”; it may never quietly decide “this needs less.”
Reasoningthe agentsdebate · analyze · propose
Knowledgethe Kernelwhat may be known
Actionthe humanwhat actually happens
Vaultowner: IRON-VECTOR-8842

The unit of sharing: the Context Grant

Agents never receive “memory.” They receive a Context Grant the Kernel constructs — minimized to the least needed, bound to one purpose and one recipient, time-bound, and tagged with provenance. Its reshare field defaults to none.

ContextGrant {
  to:          agentId        // exactly one recipient
  context:     minimizedSlice // least needed; carries provenance + stated/inferred
  purpose:     taskBinding    // usable ONLY for this task; not reusable elsewhere
  expiry:      timestamp      // time-bound; auto-revokes
  reshare:     "none"         // DEFAULT. "via-kernel-only" is the rare, explicit exception.
  sensitivity: low | medium | high | never
  grantId:     id             // logged; revocable by this id
}

Access is not transfer permission. Permission to read is not permission to re-share. Re-share scope is always separate, explicit, and defaults to none.

Sensitivity tiers — strict by default

LowAuto-approve by policy — still minimized, still loggedNon-identifying working context
MediumRequires explicit user consentContextually revealing, not core-sensitive
HighRequires explicit per-session consentIdentity, payment, recovery, relationship, health, legal, financial, legacy
Never-grantableNo consent can release it to any agent, everKeys, passphrases, recovery fragments

Default classification is conservative: anything private, identity-linked, payment-, recovery-, relationship-, health-, legal-, financial-, or legacy-related is High unless explicitly reclassified. High-tier consent is per-session; a session ends on explicit close or after an idle timeout, whichever comes first — then session-bound grants expire and must be re-consented.

Locked decisions

1

Law 4 clause — ADDED

Agent↔agent is now explicit; memory, instructions, and derived claims are all covered. No agent passes any of them to another except through Kernel-approved context.

2

Sensitivity — STRICT for v1

Four tiers including Never-grantable, with conservative default classification. Easier to relax later than to regain trust after over-sharing.

3

Re-share — NONE by default

“Access is not transfer permission” is a named core principle. Re-share scope is always separate, explicit, and defaults to none.

LAW 4 · AMENDED

The Kernel decides what crosses between human, agent, model, and tool — including between one agent and another. No agent may pass memory, instructions, or derived claims directly to another agent except through Kernel-approved context.

⚠

Honest sharp edges

The consent model is locked; collaboration design begins only on top of it. These are the places where discipline — not a checkbox — is what keeps the model honest.

Inference leak — now partly closed

The Law 4 amendment governs an agent's derived claims, not just its inputs. Enforcement still has to treat every agent output as new context before it propagates.

Purpose-binding is only as sharp as your purposes

Context released for task X is inadmissible in task Y — but keep purposes narrow and concrete, or scope quietly creeps.

Consent fatigue vs. the Law 6 floor

Tiers reduce prompts, but the receipt is never optional and Low is still minimized + logged. The dial changes interruption, never visibility.

Free-text minimization is hard

This demo minimizes by structured dims + keyword match. The discipline — evidence, minimization, audit — must hold even as extraction improves.

Design order is deliberate: consent model → collaboration → unification. Debate is cheap; the boundary is everything. This layer exists so agents can think together without any of them — or all of them — quietly deciding what you meant to keep.