Agent Model
An agent is capabilities, bound to identity, bound to authority.
HAIEC models an AI agent as a set of capabilities bound to a runtime identity bound to an authority chain. Every claim about an agent resolves to evidence — or renders honestly as unknown.
Five evidence planes
Five independent analytical planes — not a causal sequence. Each is a distinct evidence type with its own limitations. A gap between any two is a finding, not a safe state.
1
Requested
What the request asked for — intent as declared, not assumed.
2
Policy-authorized
What policy and configuration evidence establishes as permitted.
3
Effectively granted
What credential evidence establishes — not guaranteed actual authority.
4
Code-capable
What application and source evidence establishes can technically occur.
5
Observed
What connected runtime evidence establishes was observed.
Chains & comparisons
Capability chain
What a task requires vs. what the agent can actually do — the required set is compared against the observed capability set. A gap is a finding class: unmet requirement, unobserved grant, or capability exceeding what was requested. Capability is what the code can do — not evidence it is safe.
Delegation chain
Whether a human or authorized process actually delegated the consequential choice — authority narrowing (each hop can only shrink scope), scope monotonicity, and chain continuity. A break in the chain is rendered, not averaged away.
DAI — four-fact comparison
Delegated Action Integrity compares four independently-evidenced facts per surface: what was delegated, what the code is capable of, what credentials grant, and what was observed. Divergence between any two is surfaced — never reconciled silently.
What this model does not claim
- Evidence is not assurance — evidence feeds an evaluation; it is not a verdict.
- Source capability is not safety — established capability proves reach, not permission.
- Missing runtime data is not proof nothing happened — absent evidence renders as unknown.
- Unknown is never presented as pass.
Sources of truth: lib/assurance/agent-action-capability.ts, lib/ai-security/agent-view-read-model.ts, and the evidence contract in lib/evidence/.