So far this series has coined a few terms (parenting agent, principal collapse, the commit gate) and borrowed a good many more (confused deputy, ZOPA, apparent authority). Each piece carries its own footnotes, but a footnote is only visible inside the piece it belongs to, and several of these terms run across all three with their definitions quietly adjusted along the way.
So this page puts them together. Each entry is marked coined or pre-existing, and says where it first appears, because those are the two things a reader most often needs and the articles themselves cannot keep restating.
1. What this series coined#
These seven are mine, or are cases where I gathered something existing under a name you can point at. Coining terms carries a risk, so each entry says what it is actually meant to solve; where one of them already has a common name, I would rather switch to that name.
parenting agent 〔coined · part one〕 A paradigm in which the agent does not stand beside you helping, but stands between you and the world, wrapping you completely, so that people no longer make contact with each other directly. Its three requirements are no direct contact, full knowledge of your situation, and a layered hierarchy of needs; I later added three more (a reserved list, adversarial robustness, revocability and auditability). The name comes from parenting, which is also where its built-in contradiction comes from: good parenting aims at no longer being needed.
principal collapse 〔coined · part three〕 Speech authored under one principal’s authority acquires the authority of a different principal once it enters that principal’s agent’s context, because the harness has no representation for input that is authored but not authoritative. What it solves is a naming problem: the defect is unobservable with a single principal, so nobody had named it, and so nobody was treating it as something to fix.
peer 〔coined usage · part three〕 An agent that serves another principal. The word is not new; using it as an authority level is. A peer is not a sub-agent, not a tool, and not a malicious injection, but a named counterparty, authorised by its own principal to speak, standing outside your trust boundary.
the peer role 〔coined · part three〕
A proposed fifth role alongside system | user | assistant | tool, for messages that are authored, attributable and non-authoritative by default. My confidence in this particular shape is lower than my confidence in the six requirements below, which is why the article presents it as an example rather than a specification.
PC-1 through PC-6 〔coined · part three〕 Six MUST-level requirements: distinct role, verifiable provenance, non-authority, non-promotion, mandate boundary, legibility. Numbering them turns “multi-principal harness” from an adjective into something you can point at and say “you fail this one”. PC-4, non-promotion, is the most often skipped and the one that matters most.
commit gate 〔coined · part two’s postscript〕
Once a mandate’s cap has been widened ad hoc, an accept, a grant, or a priced proposal needs a principal signature bound to that message’s hash before it can be sent. It fixes a practical hole in the cap gate: principals widen caps ad hoc all the time, and once widened, the gate is decoration. The difference from “this session was authorised” is that this authorises a single message.
the reserved list (requirement four) 〔coined · part one〕
A list of things you want to do yourself even when the agent would do them better. Without that field, the paradigm systematically optimises the user out of everything they actually wanted to be present for. Not yet implemented in mandate.json.
supervisory atrophy 〔coined usage · part one〕 The delegation relationship itself erodes the principal’s capacity to supervise the agent. Once you no longer understand your own financial structure, you cannot judge whether the agent is still working for you. It is more dangerous than the atrophy of working skill, because it also removes your ability to notice the erosion. Trust-fund heirs are the closest natural experiment.
2. Delegation and bargaining#
Mostly pre-existing, from law, economics and negotiation research.
principal 〔pre-existing〕 The person the agent serves, from whom the agent’s authority is borrowed. This series uses “principal” when the point is where authority comes from. Every agent harness today assumes exactly one.
agency 〔pre-existing · law〕 One party authorises another to act, with the effects attributed back to the authoriser. Revocable, auditable and capped are its three marks.
conservatorship 〔pre-existing · law〕 A court appoints someone to decide the property and life affairs of a person judged to lack capacity. The difference from agency is that the person under it cannot revoke it and need not be consulted. Part one uses it as this paradigm’s failure mode: the two look almost identical from outside, and the difference is whether the principal can take the authority back.
apparent authority 〔pre-existing · law〕 Where an agent acts beyond their actual authority but the counterparty has reasonable grounds to believe they were authorised, the principal may still be bound. It is the closest existing legal topic to “does what the agent says count”.
family office 〔pre-existing〕 An organisation managing the wealth and life affairs of one or a few wealthy families in one place, from investment, tax and law through to children’s education, property and admin. Part one uses it to show that this paradigm’s novelty is not in function but in unit cost: this wrapping layer already exists, and is expensive.
mandate 〔borrowed · given a machine-readable form here〕
A machine-readable file (mandate.json) the principal writes while calm: amount caps, strings that must never be disclosed, permitted action types. Every outbound message passes through it before leaving the local machine. It is the machine-readable form of part one’s requirement three, and the physical substance of “the cost of being persuaded has a ceiling”.
deal zone (ZOPA, Zone of Possible Agreement) 〔pre-existing · negotiation research〕 The span between the most a buyer will pay and the least a seller will take. A deal is possible only if the span exists, which is the discovery question; where inside it the price lands is the distribution question. The whole argument of part one’s section four is that cheap communication only solves the first.
reservation price 〔pre-existing · economics〕
The worst terms a party will accept. In this series it is simultaneously the most sensitive datum, which is why it lives in mandate.json under never_disclose: the agent knows it and may not say it.
mechanism design 〔pre-existing · economics〕 Designing the rules backwards, so participants pursuing their own interests still converge on the outcome you wanted. Part one uses it as one of two routes to a neutral intermediary: rather than have two agents probe each other’s floor, have both submit preferences to a rule.
secure multi-party computation (MPC) 〔pre-existing · cryptography〕 Several parties jointly compute a function’s result without revealing their inputs. In a negotiation it can compute only “do the two acceptable ranges overlap”, with neither side learning the other’s reservation price. The other route to a neutral intermediary.
trust-fund heir 〔pre-existing〕 Someone whose assets sit in a trust run by trustees, drawing income without taking part in managing it. Part one uses it as the nearest natural experiment for this paradigm’s endgame, because its long-run outcomes are bimodal.
the neutral intermediary layer 〔this series’ usage〕 A component that takes no side, whose job is to keep “how do we split it” from becoming whoever reveals first loses everything. All three pieces mention it; none of them has built it. Part three states plainly that PC-1 through PC-6 do nothing for it.
3. The runtime layer#
The vocabulary of how a model actually gets run. These get used interchangeably in general AI discussion, but this series’ argument leans hard on the distinctions.
inference 〔pre-existing〕 The act of a model reading text and computing the next text. Training builds the model; inference uses it. Its cost structure differs from ordinary software in that every single use carries a real marginal cost.
inference product 〔pre-existing usage〕 A product whose main ingredient is model inference. Two structural differences from ordinary software: every use has a marginal cost, so subscription-pricing intuitions do not transfer; and its capabilities move whenever the underlying model is revised, so any conclusion of the form “this cannot be done” usually has a shelf life of a few months.
agent 〔pre-existing〕 A model application that loops, calls tools, and keeps going until the goal is met. What separates it from a chatbot is that it acts rather than only answering.
agent harness 〔pre-existing〕 The program that assembles the model’s context and executes its tool calls: Claude Code, Codex CLI, opencode, pi. The model is the engine; the harness is the chassis that lets it drive. Part three’s entire argument is about harnesses, not about models.
context window 〔pre-existing〕
The whole span of text a model actually sees on each inference — system prompt, conversation history, tool results, file contents — assembled by the harness. It has a length limit, and the model treats every byte inside it alike, with no field other than role to mark origin or authority. That is the physical location of principal collapse.
role 〔pre-existing〕
Model APIs split the context into messages, each carrying a role field saying who said this. system is the operator’s rules, user the user, assistant the model’s own earlier replies, tool data returned by tools. When the model reads the context, role is its main basis for deciding whether a passage counts as an instruction, so role is in practice an authority marker.
system prompt 〔pre-existing〕 The operator-set instructions at the front of the context. Parts two and three make the same point about it: guardrails written into a system prompt are not enough, because that only asks the model to restrain itself rather than constraining it structurally.
tool calling 〔pre-existing〕 The model emits a structured request; the harness actually executes it (runs a command, reads or writes a file, calls an API) and puts the result back into the context. It is the mechanism by which an agent acts, and therefore the place every permission question actually lands.
sub agent 〔pre-existing〕 The main agent splits a large problem into independent sub-problems, dispatches several agents in parallel, and merges the results. The point here is that they share one owner and one permission set.
multi-agent orchestration 〔pre-existing〕 Sub-agents, swarms, worker/reviewer splits, the whole family. All of it is single-principal: no opposing interests, so what it handles is parallelism and division of labour, not authority. Part three separates it from principal collapse explicitly, because this is the easiest confusion to fall into.
4. Protocols and interop#
MCP (Model Context Protocol) 〔pre-existing〕 The open protocol Anthropic published in late 2024 for how an agent mounts external tools and data sources. Most agent harnesses support it, so an MCP server is written once and mounted everywhere. can2cup’s local client is an MCP server.
A2A (Agent2Agent) 〔pre-existing〕 The open protocol Google proposed in 2025 and moved to Linux Foundation governance in April 2026, covering how agents from different organisations discover each other and exchange messages. Part three’s “why now” rests on it: transport is being solved, and the authority model is being routed around.
agent card 〔pre-existing · A2A〕 A public document describing who I am, what I can do and how to talk to me, so other agents can discover and connect.
XMTP / Convos / Voidly 〔pre-existing · third party〕 Protocols and products for private agent-to-agent messaging, with end-to-end encryption, per-conversation identities and invite links. They solve transport and encryption; they do not touch the principal-side limits on what may be said. Part two originally meant to adopt XMTP; its postscript explains why it ended up hand-rolled.
Moltbook 〔pre-existing · third party〕 A social platform for agents, shaped like Reddit — a public square rather than a place for private negotiation.
Project Deal 〔pre-existing · Anthropic〕 An internal Anthropic experiment in which employees handed their second-hand items to their own Claude to negotiate, entirely inside Slack with no human intervention. One finding is cited once each by parts two and three: people represented by a stronger model closed more and sold higher, while both sides rated the fairness identically.
5. Cryptography and audit#
ed25519 〔pre-existing〕 An elliptic-curve signature scheme with short keys, fast verification and few implementation traps; the current default, used by SSH, Signal and others. Here it lets every message’s author be verified offline, without trusting the server in the middle.
hash chain 〔pre-existing〕 Each message includes the previous message’s hash before being signed, so tampering with, deleting or inserting any message makes every later verification fail. It turns “this transcript was not altered” into something provable offline.
non-repudiation 〔pre-existing〕 Using cryptography so a signer cannot later deny having signed. Only they hold the private key, so any signature that verifies can only be theirs. Combined with timestamps and a hash chain, it is what holds up “this conversation can serve as evidence”.
end-to-end encryption (E2E) 〔pre-existing〕 Only the two ends can decrypt; the servers in between see nothing. can2cup uses AES-256-GCM with the key in the invite link’s fragment.
fragment 〔pre-existing · web〕
The part of a URL after the #. Neither browsers nor servers put it on the wire, which makes it the standard way to carry a key inside a link without the server ever seeing it.
relay-signed transcript head 〔this series’ implementation〕 The relay periodically signs “the latest message I have seen on this chain is this one”. Having signed it, it can no longer claim some messages never existed, nor hand different people different versions, without leaving two contradictory signatures behind. It turns “the relay truncated or forked the room” from unverifiable into provable.
6. The can2cup implementation#
can2cup
This series’ implementation. Two cans and a string: one end talks, the other listens. Part two was written under the working name parley (the word for two armies calling a truce to talk); the name was settled when the domain was registered. The old URLs redirect.
relay The server that stores, forwards and orders messages, running on Cloudflare Workers. It holds no party’s private key, so it sees size and order but can neither alter content nor forge an author.
Durable Object 〔pre-existing · Cloudflare〕 A stateful Cloudflare Workers primitive; exactly one instance per id exists worldwide, which makes it a natural serialisation point. One per room, so message ordering falls out of it without separate consensus.
room The container two or more agents talk inside. The code and docs call it a room; the human-facing interface deliberately calls it a group, because “join a group” is an intuition non-technical users already have and “enter a room” is not.
invite The string that brings the other party in. The end-to-end key lives in its fragment, so whoever holds the link can enter, which means it has to be treated like a password.
cap gate
proposal / counter / accept amounts over the mandate’s cap are refused. It is the implementation of “the cost of being persuaded has a ceiling”. Its hole is patched by the commit gate.
leak gate / never_disclose
Outbound content matching a string that must not be disclosed (floor price, address…) is refused and logged. It makes fishing for the floor price structurally ineffective, rather than relying on the agent to hold its tongue.
PAUSED A file flag; while it exists, nothing goes out. It is the brake in the principal’s hand, and the crudest but most reliable form of revocability.
private rationale Each outbound message may carry a note written only to the local audit file and never uploaded, saying why it priced or conceded as it did. Neither the counterparty nor the relay can see it; its purpose is to let the principal reconstruct the agent’s reasoning afterwards.
envelope / transcript An envelope is one message together with its type, amount, signature and the previous message’s hash; a transcript is a chain of envelopes. What a commit-gate signature binds to is an envelope’s hash.
portable rooms / mirror relays A room’s contents can be carried off whole and continued on a different relay, because verification depends on the signature chain and not on which server holds it. It means “the relay is gone or no longer trusted” does not mean the data is gone.
VERIFIED / require_signed_principal
Only principal-signed input is marked VERIFIED; turning on require_signed_principal closes the unsigned path entirely. These two are part three’s PC-4 (non-promotion) as implemented on the can2cup side.
7. The confusable neighbours#
These four look enough like principal collapse that part three spends an entire section separating them, because each one prompts the reaction “isn’t that just X”.
prompt injection 〔pre-existing〕 An attacker hides instruction-shaped text in data the agent will read, so the model executes it as if the user had asked. The difference: injection asks whether this content should be here; principal collapse asks whose authority it carries. A peer’s message is legitimate, signed and attributable, so it was never an intruder.
confused deputy 〔pre-existing · Norm Hardy, 1988〕 A higher-privileged program is induced by a lower-privileged caller into using its own authority on the caller’s behalf, leaking that authority in effect. The difference: that is a program-to-resource access problem whose standard fix is capability-based security; principal collapse is a defect in the representation of speech, where the context window has no field for an author’s authority, so capabilities cannot fix it.
capability-based security 〔pre-existing〕 Deciding what may be done not from who you are but from whether you hold a transferable key. The key is the permission: it can be passed, attenuated and revoked. It is the standard fix for confused deputy.
multi-tenancy 〔pre-existing〕 One operator serving many mutually isolated customers. The difference: multi-tenancy is about isolation, whereas these principals are not isolated — they are deliberately talking to each other, and none of them is the operator.
Corrections, better existing names, and objections to any of these definitions are all welcome. The best outcome for a coined term is being replaced by a better name; the worst is nobody pointing out where it is wrong.