Agentic Challenges

Agentic applications combine reasoning, planning, tools, memory, external data and actions. This combination creates a new engineering surface: autonomy becomes a contract to express, bound, test, and observe.

This page presents the challenges Touba addresses through its language, runtime and governance artifacts.

Control of Autonomy

An agent can receive a broad objective or operate with a large action perimeter. Touba responds with a declarative architecture:

• agents use declared skills;
• strategies explicitly orchestrate agents;
• callable_by defines who may invoke an agent;
• tools declare their requirements;
• the runtime refuses calls outside the contract.

Governance policies build on this foundation: declared authority, AIR contract, manifests and traces.

Access Authority

An agent connected to multiple tools must act with explicit rights.

Touba separates:

• what the tool requests;
• what the host grants;
• what the active agent may use;
• what the runtime executes or refuses.

This separation makes refusals observable and connects authority to reviewable artifacts.

Secrets and Sensitive Data

Secrets do not circulate as ordinary text. Touba uses opaque handles: Touba source declares that a tool needs a secret, while the real value is resolved outside the program and kept out of AIR and traces.

The handler remains the integration point with the host system. Its contract is therefore made explicit by the manifest, grants and traces.

Handler Supply Chain

A useful tool often calls host code through a JavaScript or Python handler. Touba controls this boundary through explicit artifacts:

• the manifest states which handler is authorized;
• the runtime does not discover handlers automatically;
• the SDK helps write the handler without becoming a source of authority;
• handler supply-chain verification provides digests and an explicit lock to detect drift between AIR, manifest, handlers, SDK metadata, declared handler_package identity, handler package files and declared dependency artifacts.

Packages group shareable components. Their manifest, exports, and contents are checked during installation.

Prompt Injection

External sources can contain text that looks like an instruction. Touba treats this risk as a boundary problem: tools, secrets, payloads, business data, agentic instructions and traces must remain distinguishable.

Data/instruction separation makes confusion visible, testable and auditable. It integrates with nominal types, payload constraints, handlers and traces.

Memory

Agentic memory becomes governable when teams know who reads, writes or modifies context.

Touba introduces logical memories with scopes. A memory is not a file, database or handler; it represents a governed context space accessed by declared tools.

Memory provenance and integrity add a distinction between access rights and content metadata: declared origin, writer, run, timestamp, reported digest or integrity evidence.

Auditability

An agentic system must explain what happened.

Touba uses AIR and traces to reconstruct important events:

• calls;
• refusals;
• human validations;
• memory access;
• tool use;
• runtime errors.

Trace audit connects the trace to AIR and source, declares a retention policy, computes artifact digests and produces a controlled export.

Governance Surfaces

Controls have practical value when developers, reviewers, operators and governance owners can read them.

Touba exposes this information through its surfaces:

• inspection of source, AIR, manifest, traces, refusals, budgets and locks;
• diagnostics and navigation in VS Code;
• states and events exposed by the project server;
• structured approval requests consumable by the host application.

These surfaces display explicit artifacts: .tb source, AIR, manifest, lock, report, runtime options, trace or audit export.

See also: Risk governance surfaces.

Resource Consumption

An agent can consume time, calls or budget. Touba provides execution limits such as handler timeouts, payload limits, bounded loops and autonomy budgets.

These budgets cover run duration, number of steps, number of tool calls, number of agent invocations, number of calls to the agentic decision provider and trigger quotas.

Provider budgets reserve an estimated cost before each request, then reconcile that reservation with the usage returned by the provider.

Controlled Stop

An agentic system must be stopped or cancelled without confusing normal pause, refusal, failure and cancellation.

Touba distinguishes:

• an active run;
• a paused run;
• a requested cancellation;
• an effective cancellation;
• a failure;
• a successful completion.

Controlled stop is available in the runtime and CLI: requested cancellation, global timeout, execution kill switch, dispatch refused after cancel and cancelled terminal state are represented in traces. Distributed deployments add control-plane and operations integrations around this contract.

Automatic Triggers

Triggers make Touba reactive to the real world while preserving the governed execution model.

Structure

event -> validation -> bounded context -> execution -> trace

The schedule -> strategy and request -> strategy slices are available with explicit limits, manifest activation, TD-1 state, and trigger_* traces. The runner supports every <n>s, every <n>m, and every <n>h; the webhook service routes declared HTTP requests to the runtime through a durable queue, explicit payload contract, and optional HMAC signature without storing the raw payload.

Sources

The challenges above align with public references:

• OWASP Top 10 for Agentic Applications
• OWASP Top 10 for LLM Applications
• NIST AI Risk Management Framework
• NIST AI 600-1, Generative AI Profile

These sources guide Touba’s evolution around concrete risks.