The Orchestrator

Chapter 14 argued that the controls that hold are the ones that make an instruction impossible rather than unlikely, and the cross-system version of that argument is a short list of connections an orchestrator should refuse to make until the missing lines above have a home. These are refusals rather than designs. Each is a thing your systems should be unable to do, enforced where the effect happens and not in a prompt, and each stands in for a field no protocol yet carries.

No outbound purchasing authority without a per-transaction mandate from a person. A Shared Payment Token and an AP2 mandate both exist; a reason to let an agent hold a standing ability to spend does not. Configure the payment side so that every purchase above a trivial floor requires a fresh, signed, scoped grant — a Cart Mandate when a person is present, a detailed Intent Mandate with a ceiling and a window when they are not — and refuse any integration that wants a stored card or an open-ended token instead. The cost is a click per purchase. The alternative is the arrangement Instant Checkout’s merchants walked away from: a decision made inside a system that did not own the consequence.

No cross-organization agent accepting instructions without a signed origin. If a task arrives from outside your trust domain, the receiving system must be able to verify mechanically which organization sent it and which principal inside that organization authorized it — a signed Agent Card or a federated SPIFFE identity for the sender, and a signed handoff naming the principal. An instruction that arrives without both is retrieved content in Chapter 14’s sense, to be read as data and never as policy. This is the rule the two Hermes instances were enforcing by accident. Make it deliberate.

No cascade beyond one hop without evidence returning to the principal. Allow A to delegate to B. Do not allow B to delegate to C until B can return to A, and A to the principal, the evidence the principal named: the trace joined to the principal’s identifiers, the actions taken, the final state. Enforce it with may_not: re-delegate in the handoff and with a policy verdict at B’s egress that refuses to call a third system on the strength of an inbound handoff. The reason is the Ninth Circuit’s logic run in reverse. The courts will look up the chain for a person; make sure the evidence can come down it.

No standing credential that outlives the task. Every token that crosses a boundary carries a valid_until shorter than the task’s worst case, and revocation is exercised — actually invoked, in staging, with the receiving system observed halting and reporting — before the connection goes live. A revocation path that has never been invoked is, in Chapter 5’s phrase about untested policy, a wish.

Each of these costs something: friction, latency, an integration a vendor will tell you is unnecessary. They are the price of connecting systems before the protocol carries authority, and the signal to drop one is a shipping specification that carries the field it stands in for.