Agents

The industry conversation about agents focuses on capability: what the model can do. PING focuses on authority: what the agent is allowed to do, enforced by the system rather than requested of the model. A sufficiently clever prompt cannot substitute for a permission boundary, because prompts are suggestions and boundaries are guarantees.

The practical pattern: agents receive repository and deployment capabilities, not credential piles. An agent that deploys through git plus the platform's native integration never needs the platform's password. Fewer secrets, fewer ways to fail.

One concrete boundary PING uses daily: agents execute commands on machines by passing script bytes on standard input, never by embedding commands inside other shells' quoting layers. Each layer that reinterprets a command is a place where meaning can corrupt silently. Removing the reinterpretation removes a whole class of failures.

The general principle: every boundary crossing (machine, process, permission domain) should move data as opaquely as possible and interpret it as late as possible. Clever quoting is a liability; boring pipes are an asset.

Agents should move fast on reversible actions (reads, drafts, proposals) and slow down on irreversible ones (deletes, publishes, credential changes, anything that rewrites history). The more irreversible the operation, the higher the proof requirement before acting, and the stronger the preference for human confirmation.

This is not timidity. It is the same discipline as the rest of PING: be bold where failure is cheap and recoverable, conservative where it is not.

When PING delegates to a worker (another agent, a research model, a script), the worker contract is the full evidence lineage: raw artifact, extracted observations with source spans and confidence, verification status, preserved contradictions. The worker's output is unverified external material until it passes the verification gate. Trust is earned per claim, not per worker.