Kill Semantics:
Budget, Counterparty, Violation
Draft — S2.4 · series: CONTENT-ROADMAP-99 S2 (Governance
& Doctrine) · status: published · grounding: moses-governance + PSAA
+ Faengz doctrine + meta-llm-charter · wiki_concepts:
platonic-solid-access-architecture, credit-safety, moses-governance,
narrow-gate-principle, faengz-doctrine · skills: moses-governance ·
tags: ai-governance, autonomous-operations, security, kill-semantics,
solid-keys, budget-control, policy-enforcement, digital-sovereignty,
ai-agents
Every solid-key carries two halves. The KEY half grants — skills,
contexts, relationships, the geometry of authority. The KILL half
revokes — and what it revokes, how it revokes, and what happens
after the revocation is the difference between a system that
contains its agents and a system that merely hopes they behave.
We built the kill semantics of the Platonic Solid Access Architecture
(PSAA) after watching an agent burn through $40 in fourteen minutes. The
agent hadn’t broken any single rule. It had spawned a child, which
spawned a microshark, each inheriting a paid model config. Each call was
small. The multiplicity was the problem. By the time anyone noticed, the
budget was gone and the agent was still running. The lesson wasn’t “add
a budget cap.” It was “define what happens when the cap is hit —
structurally, not advisory.”
There are three primary KILL triggers in our system: budget
exceeded, counterparty killed, and
violation. Each solves a different failure mode.
Together, they form a complete kill grammar — a formal set of rules for
how authority terminates.
Budget exceeded: when
the geometry shrinks
the geometry shrinks
The budget_exceeded trigger is the most common kill
condition. Every agent carries a token budget — a ceiling on how many
tokens it can consume per hour. When that ceiling is hit, the solid-key
doesn’t just flash a warning. The geometry itself
changes.
A cube-key agent (T2) with 6 skills, 8 contexts, and 12 relationships
that exceeds its budget doesn’t get told to slow down. It gets
downgraded to tetrahedron — 4 skills, 4 contexts, 6
relationships. The faces, vertices, and edges that represent its
capabilities are stripped. The geometry is the policy, and the
geometry shrinks.
This is not a soft suggestion. MOSES (the Model Orchestration and
Security Engine) enforces it at the enforcement boundary. When
budget_exceeded fires, MOSES acts immediately: it rewrites
the agent’s solid-key, writes an immutable audit decision to the council
log, and the agent’s next tool call finds that the tool it tried to use
is simply not in its geometry anymore. No conversation, no warning, no
graceful degradation. The capability is gone because the shape that
encoded it is gone.
Two properties fall out of this design:
- Cost control is access control. The same
cryptographic primitive that grants capability also enforces spend.
There is no separate accounting system to be bypassed — the budget is in
the token. - Downgrade, not delete. A budget-busting agent
remains alive and useful, just at a reduced scope. This matches
operational reality: the fix for overspend is to constrain, not to
destroy the worker.
The budget trigger also carries a temporal component. A tetrahedron
that was downgraded from a cube can request restoration after its budget
window resets — but only if its parent agent approves the escalation.
The downgrade is a punishment with a path back, not a death
sentence.
Counterparty killed:
cascading revocation
cascading revocation
The counterparty_killed trigger solves a structural
problem that budget exceeded doesn’t touch: what happens when
one agent’s authority depends on another’s?
In a mesh of agents, relationships are first-class citizens. A
cube-key agent has 12 peer relationships — edges connecting it to other
agents in the mesh. When one of those peers is killed (by budget, by
violation, by manual revocation), the surviving agent still carries the
relationship edge to a dead peer. This is a dangling reference —
authority that points at nothing.
The counterparty trigger collapses these dangling references. When
Agent A is killed, every agent that held a relationship edge to Agent A
gets that edge stripped. If Agent B was an octahedron (8 relationships)
and one of its 8 edges pointed at Agent A, Agent B becomes a heptahedron
(7 relationships) — or, more precisely, its solid-key is rewritten with
one fewer edge.
This cascading effect has a design constraint: it stops at
the boundary. Counterparty kills propagate one hop, not two. If
Agent B loses an edge because Agent A died, Agent C does not lose an
edge because Agent B lost an edge. The cascade is bounded. Without this
constraint, killing one rogue agent could collapse the entire mesh — a
single point of failure masquerading as a kill switch.
The counterparty trigger also carries an identity implication. When
an agent loses a relationship edge, its scope narrows. An octahedron
that loses two edges to counterparty kills becomes a hexahedron — and a
hexahedron has different access rights than an octahedron. The agent
doesn’t know it lost peers; it knows it lost capabilities. The
effect is the same as a budget downgrade, but the cause is structural
rather than economic.
Violation: policy as kill
condition
condition
The violation_<rule_id> trigger is the sharpest
tool in the kill grammar. Where budget exceeded is gradual and
counterparty killed is structural, violation is immediate and
absolute. When an agent violates a council policy, the
violation trigger fires and the solid-key is revoked entirely — not
downgraded, not constrained, revoked.
MOSES enforces violations through the policy registry. Every agent
action is checked against the registry before execution. The registry
contains five categories: Security, Operations, Data, Network, and
AI/Governance. Each category has forbidden operations and required
authorization levels. An agent attempting a forbidden operation triggers
an immediate violation — the solid-key is burned, the audit log records
the decision, and OpenFang receives an escalation alert.
The violation trigger has a design property that distinguishes it
from the other two: it is not recoverable by the agent.
Budget downgrades can be restored. Counterparty kills can be compensated
by acquiring new peers. But a violation kill is permanent for that
agent’s session. The agent must be re-provisioned with a new solid-key
by a human or a higher-tier agent — the geometry cannot be reconstructed
from within.
This is the narrow gate in action. The Faengz Doctrine declares that
“the gate is narrow: unified calls or none at all.” The violation
trigger is the mechanism that enforces that principle. An agent that
violates policy doesn’t get a second chance within its current session.
It gets a new session, a new key, and the audit trail of why the old one
died.
Three categories of violation exist:
- Security violations — direct shell access to
production, unauthenticated data access, privilege escalation. These
trigger immediate kill plus OpenFang escalation. - Data violations — export to external services,
deletion of audit logs, PII access without encryption. These trigger
kill plus data steward notification. - Governance violations — forking council agents
without review, publishing policy changes without consensus. These
trigger kill plus council membership review.
The escalation path matters. A security violation doesn’t just kill
the agent — it alerts OpenFang, which generates an incident ticket and
notifies the council security team. The kill is the immediate
containment; the escalation is the investigation.
The kill grammar as a
system property
system property
Budget exceeded, counterparty killed, and violation — these three
triggers form a complete kill grammar for a multi-agent system. Budget
handles economic failure. Counterparty handles structural failure.
Violation handles behavioral failure. Together, they answer the question
that every multi-agent deployment must answer: when an agent exceeds
its authority, what happens?
The answer is not “we tell it to stop.” The answer is not “we hope
the system prompt prevents it.” The answer is: the geometry
changes. The shape that encodes authority is the same shape
that enforces limits. A solid-key that grants 6 skills also defines the
boundary of 6 skills. When the boundary is crossed, the geometry
shrinks, collapses, or is destroyed — and the agent discovers what it
can no longer do the next time it tries to do it.
This is the architectural principle that separates governance from
policy. Policy says “don’t do that.” Governance says “you can’t
do that, because the shape that would let you no longer exists.”
Grounded in the PSAA KILL triggers specification
(tier_downgrade, session_expired, identity_compromise, budget_exceeded,
violation_
self_destruct), the moses-governance skill’s enforcement path, the
Faengz doctrine’s narrow-gate principle, and the real credit-bleed
incident that motivated the budget-trigger design. The kill grammar is
not a thought experiment — it is the enforcement layer that makes the
rest of the governance stack real.
Semantic Relationships
- [[platonic-solid-access-architecture]] — orchestrates
- [[credit-safety]] — orchestrates
- [[moses-governance]] — orchestrates
- [[faengz-doctrine]] — orchestrates
- [[narrow-gate-principle]] — orchestrates
- [[openfang]] — orchestrates
