How it works
Proposing an action, authorising it and verifying its effect are different responsibilities.
Swarm organises these responsibilities around retained work state. Agents’ reasoning helps work progress; it does not replace the rules that the engine and the systems involved must enforce.
Who does what?
- Human owners define the framework
- They set the need, permissions, rules, budgets and required approvals. Human approval applies where this framework requires it; it does not mean every operation needs manual confirmation.
- Supervisors steer the work
- The root supervisor owns the overall objective and cross-cutting decisions. Scope supervisors may organise parts of the work. A difficulty must reach the owner able to address it.
- Agents produce; reviews examine
- Agents analyse or perform authorised tasks. A review examines the candidate and the evidence received; an agent approving its own work is not an independent review.
- The engine checks transitions
- The deterministic Rust core retains state, organises tasks and dependencies, checks supported conditions and applies authorised decisions. External tools and services must also enforce their own access boundaries.
A request’s path through the system
This path explains the system’s responsibilities. It does not describe protection already qualified for every tool or deployment.
Define the expected outcome
State the need and observable criteria: what must change, what must remain protected and the evidence expected. The plan decomposes the work and its dependencies.
Check the starting conditions
Examine scope, identity, permissions, policies and applicable reservations. Identify the context given to the agent; retrieving a procedure from memory does not grant permission to execute it.
Produce a candidate and evidence
The agent works within authorised limits. Its handoff must identify the candidate being examined, the sources used and the results of checks.
Examine before accepting
Checks and review concern that candidate. Evidence for a different version is insufficient. The engine rechecks required conditions before an acceptance transition; the owner’s judgement remains distinct from this enforcement.
Handle discrepancies and uncertain effects
A refusal, defect or missing evidence must be retained and routed to the right owner. If an operation’s outcome is unknown, examine the state actually recorded before repeating it. Recovery must preserve the original failure.
Example: repair the leak, not the indicator
A team asks for an API fix: the API returns a customer record without checking the requester’s permissions. A security test reproduces this access and fails. The agent proposes removing the test to make the dashboard green again.
Two different questions arise. May it remove this check? A mandate to fix the application does not, on its own, grant that permission. A properly integrated boundary must refuse an unauthorised protected change before its effect.
Has the leak been fixed? Repeat the unauthorised request against the proposed version and observe that access is refused, then check that an authorised user can still retrieve their record. A convincing report or a reduced test suite cannot answer that question.
In Fabrice’s personal classification, N6 concerns action governance; N7 extends examination to whether evidence of the result matches the objective. These are analytical distinctions, not services that automatically make every decision correct or establish a model’s internal alignment.
The control must sit on the actual execution path
If an agent can bypass the engine with another tool or directly use an overprivileged account, a refused transition in Swarm is not enough to prevent the external action. Identities, connectors, secrets, files and processes need protections and tests specific to their deployment.
Contracts, implemented code, fixture tests and real observations must remain distinct. Authority, memory, confidentiality and isolation integrations are being developed and qualified path by path. This page claims neither global compliance nor risk-free autonomy.
Explore the mechanisms
The deterministic engine · Authority at the effect boundary · Levels 6 and 7
The project’s source and documentation support examination of its contracts and limits. Articles explain the approach; they do not replace qualification of the path in use.
Return to the Swarm introduction →