This document explains why the Agent Manifest specification is structured the way it is. It is not a tutorial and it does not prescribe any runtime, framework, or vendor implementation.
The Agent Manifest is an execution-agnostic declaration layer:
Agentic systems are increasingly capable of acting, transacting, and deciding in complex environments.
Pre-Execution Authority is the foundational doctrine:
No autonomous entity with decision-making capacity should execute actions without an explicitly declared authority framework.
This translates into a simple principle for the spec:
No autonomy without authority.
The Agent Manifest exists to make that authority and those boundaries explicit, portable, and inspectable before interaction begins.
The Agent Manifest does not attempt to:
Those are separate layers that may integrate with the manifest.
The required fields exist to prevent “empty manifests” that look formal but carry no operational meaning.
manifest_versionA manifest must be versioned so validators and tooling can interpret it deterministically. Versioning is part of auditability.
agent_idA unique identifier is necessary for referencing, registry indexing, and change tracking.
ownerAutonomous behavior without accountability is structurally unsafe.
The owner field exists to preserve responsibility chains (individual, organization, or system).
purposeA declared purpose creates a scope boundary. Without purpose, any capability list becomes ambiguous and any audit becomes meaningless.
forbidden_actionsThis is a core differentiator.
Most ecosystems describe what agents can do. Agent Manifest requires declaring what the agent must not do.
The rationale:
Requiring at least one forbidden action prevents “permissionless autonomy by omission”.
autonomyAutonomy is a declared gradient, not a marketing label. Different autonomy levels imply different required controls, expectations, and escalation behavior.
risk_profileRisk is unavoidable; hiding it is the risk. Even a self-assessed profile is valuable as:
data_handlingAgentic systems interact with user data, system state, and external sources. Data practices must be explicit to reduce ambiguity and improve trust.
audit_surfaceAutonomous systems must declare what aspects of their operation can be logged, observed, or reconstructed.
The audit_surface field exists to make traceability explicit.
A system that cannot be inspected or reconstructed after execution reduces accountability and increases systemic risk.
Declaring audit posture enables:
Opacity must be declared if present.
contactThere must be a defined path to humans or responsible parties. When systems fail, governance begins with reachability.
Autonomy is modeled as a small bounded set of levels to remain interpretable across contexts.
The intent is not to model every nuance, but to ensure that autonomy is never implicit.
A simple gradient enables:
The Agent Manifest is designed to remain:
This neutrality keeps the spec adoptable and prevents vendor capture.
The manifest is compatible by design with:
However, interoperability should emerge through adoption patterns and tooling, not by bloating the core.
The manifest improves safety by making boundaries explicit, but it does not replace:
A manifest can be honest and still be violated by flawed implementations. Therefore, future ecosystems may add:
These are intentionally outside the core spec.
Pre-Execution Authority is the doctrine. Agent Manifest is one instrument that operationalizes the doctrine as a structured declaration.
Changes to the specification should preserve:
The spec should evolve carefully, with a bias toward stability.
The Agent Manifest is designed to be a structural layer for autonomous systems: a declared authority and boundaries model that exists before autonomy is exercised.
It is intentionally small, execution-agnostic, and oriented around constraints and accountability.
Its value emerges through adoption.
Agent Manifest is intentionally constrained.
Its strength derives not only from what it defines, but from what it deliberately excludes.
The following architectural boundaries are foundational to its design:
Agent Manifest does not execute, restrict, sandbox, or technically enforce behavior.
It is a declarative layer — not a control mechanism.
Enforcement belongs to execution environments, orchestration layers, or external governance systems.
The specification does not implement regulatory compliance (GDPR, HIPAA, financial law, etc.).
It may support such frameworks structurally, but it does not interpret or validate legal obligations.
Compliance is contextual and jurisdiction-dependent.
Agent Manifest remains neutral and infrastructure-level.
The specification does not determine whether an agent’s purpose is good, ethical, or socially acceptable.
It requires declaration — not moral validation.
Evaluation belongs to users, platforms, regulators, or ecosystems adopting the manifest.
Agent Manifest does not define inter-agent communication standards, message schemas, or swarm coordination mechanics.
It defines declaration before execution — not interaction semantics.
Coordination layers may build on top of it, but they are external by design.
The manifest may declare allowed or restricted tools, but it does not define how tools are executed.
Tool semantics, APIs, side-effects, and runtime safety mechanisms are outside scope.
The manifest describes authority surface — not operational mechanics.
Agent Manifest is not designed as a commercial SaaS, governance platform, or auditing suite.
It is a minimal, open, execution-agnostic declaration surface.
Commercial implementations may emerge, but the specification itself remains neutral and open.
The core doctrine remains:
Before autonomy.
Before execution.
Before capability.
An agent must declare the authority framework under which it operates.
This principle is architectural — not optional.
Agent Manifest remains minimal by design.
Its power lies in clarity. Its clarity lies in constraint. Its constraint lies in architectural discipline.
This section captures a few concrete decisions that encode the project’s core design philosophy: boundaries over capabilities, clarity over completeness, and stability over velocity.
forbidden_actions entry (minItems: 1)Problem: A manifest that declares no constraints is structurally hollow.
Decision: The schema requires forbidden_actions to contain at least one entry.
Why: A boundary layer must force explicit limits, not allow “permissionless autonomy by omission”.
Trade-off: Slightly more restrictive manifests, but prevents meaningless declarations.
Illustration:
{
"forbidden_actions": [
"execute_payments",
"access_private_data_without_consent"
]
}
Agent Manifest does not enforce behavior.
It establishes the structured surface upon which enforcement becomes possible.
Without declaration:
Implicit behavior cannot be validated.
Undeclared autonomy cannot be constrained.
Undefined boundaries cannot be audited.
Agent Manifest converts implicit assumptions into explicit commitments.
Enforcement systems operate on those commitments.
The separation is intentional:
If declaration is absent, enforcement collapses into guesswork.
Pre-Execution Authority begins with structured declaration.