Bounded Autonomy

In Touba, an agent chooses actions within a declared scope: capabilities, callers, accessible data, and budgets.

Touba targets bounded autonomy. An agent can be invoked by an authorized caller, list the capabilities declared in uses, request a decision from a configured provider, execute a selected capability, reuse the result as an observation for a later decision, and refuse any choice that does not appear in uses.

The provider uses a structured interface or the provider’s native tool calls. Both pass through the same checks: target, arguments, and callable_by for delegation. Touba records the decision. The provider tutorial presents both interfaces under the same authority contract.

Each agent's decision loop remains sequential. Multiple invocations can run concurrently inside a parallel group declared by a strategy or skill. Each branch retains its own data, caller and scopes; run counters and cancellation are shared. Concurrency grants no additional capability. See Strategy.

What Bounds an Agent

The observable scope comes from several contracts:

Contract	Role
uses	responsibilities the agent may execute
callable_by	strategies or agents allowed to invoke it
secret scopes	secret handles accessible while the agent is active
memory scopes	logical memories that may be read or modified
manifest	handlers, grants, secrets, and limits granted by the environment
trace	authorization, refusal, and pause events

Syntax

source.tb

agent AgentName
    description "Selects a declared capability for this responsibility."
    responsibility "Selects a declared capability for this responsibility."
    uses SomeSkill
    callable_by strategy StrategyName

strategy StrategyName
    description "Runs the governed agent entry point."
    uses AgentName
    do
        AgentName

uses declares what the agent may execute. callable_by declares who may invoke it.

When an agent decision is supplied to the runtime, Touba traces:

• the capabilities authorized by uses;
• the received decision;
• the selected capability;
• or the refusal when the requested capability is outside the declared scope.

When a decision provider is configured, the runtime also traces:

• the short decision request with a redacted digest;
• the full catalog request if the provider asks for it;
• provider call attempts, provider returns, and bounded retries;
• non-secret provider metadata;
• the presence of arguments supplied for the selected capability, without tracing raw values.

Without an explicit decision or provider, an agent with one capability can be selected automatically. An agent with multiple capabilities requires a structured decision.

Example

source.tb

type DatasetRequest
    query is Text

type DatasetBrief
    summary is Text

tool SearchDatasets
    description "Search public dataset records for the requested topic."
    takes request as DatasetRequest
    gives DatasetBrief
    requires network

skill BuildDatasetBrief
    description "Prepare a governed dataset brief from declared search capabilities."
    takes request as DatasetRequest
    gives DatasetBrief
    uses SearchDatasets
    do
        SearchDatasets
            with request as request
            into result
        give result

agent Researcher
    responsibility "Fulfill the declared Researcher responsibility using only authorized capabilities."
    uses BuildDatasetBrief
    callable_by strategy RunDatasetResearch

strategy RunDatasetResearch
    uses Researcher
    do
        Researcher

In this example, Researcher may execute BuildDatasetBrief. It is not free to call any tool or any other agent. RunDatasetResearch is the authorized caller.

Human Decision

Touba distinguishes two situations:

• mandatory human approval in the flow;
• human review requested by agentic logic.

In both cases, pause and resume are explicit. A human approval remains a runtime decision; it does not automatically become a formal proof.

Runtime Contract

The current bounded autonomy contract focuses on:

• explicit invocation authority;
• explicit capability selection;
• runtime refusal before out-of-scope execution;
• traceable provider decisions;
• bounded sequential agent loops and explicitly declared parallel groups;
• no implicit access to tools, memories, secrets, or handlers outside the declared graph.

Complete this scope with provider cost budgets and the hardened execution profile, according to your application’s requirements.