Agent Invocation Authority

callable_by declares who may invoke an agent.

source.tb

agent Researcher
    responsibility "Fulfill the declared Researcher responsibility using only authorized capabilities."
    uses BuildDatasetBrief
    callable_by strategy RunDatasetResearch

Rule

Authorized callers are bounded:

• strategy;
• agent.

A skill is not an authorized caller through callable_by.

For an agent imported from another module, the caller must be named explicitly:

source.tb

agent Reviewer
    responsibility "Fulfill the declared Reviewer responsibility using only authorized capabilities."
    callable_by strategy examples.agent_app.RunReview

Why It Matters

Without explicit authority, an agent could be invoked from an unintended flow.

With callable_by, the runtime verifies before entering the agent:

Output

authorized caller -> invocation accepted
missing caller    -> invocation refused and traced

Trace

Useful events:

• agent_invocation_authorized;
• agent_invocation_refused;
• failure_detected.

The trace shows that a rule was applied. It does not claim that the agent is reliable.

callable_by does not decide which capability the agent uses. After entering the agent, the runtime applies the uses contract and may call a governed decision provider. That provider selects an authorized capability; the runtime refuses any target absent from uses.

If the agent consumes a capability, the result can return to the provider as an observation for the next decision. This loop remains sequential and bounded: callable_by controls entry into the agent, uses controls the resource catalog, and the runtime keeps execution authority.

Separate data and contexts

Each invocation owns its local values and agent/caller identity. Structured arguments and provider/handler exchanges are copied: modifying a received JavaScript object cannot change Touba authority, parent data or the runtime's retained observations. A provider retry receives a fresh copy of the original request.

Budgets and cancellation remain shared across the run. Delegation grants no new authority to the parent and does not reset counters. To share persistent data, use explicitly declared and authorized memory, not an object reference retained by an adapter.

This data isolation does not sandbox arbitrary host JavaScript. Inside a parallel group it separates branches without changing the source caller or transferring one branch's authority to another. The same checks apply to imported agents with resolved signatures. See Strategy.

Runtime Contract

The current contract provides explicit caller references, traceable authorization, and refusal before an unauthorized agent invocation.

Signed cryptographic caller tokens, internal agent capabilities, richer policy languages, and module-wide authorization extend the same caller contract.