Authority is not a key

Everyone wants agents to act. Nobody can hand them the keys. That is the whole impasse of this age of machines that work: the agent is capable, the task is real, and the credentials stay locked in a drawer — because once a key is given, it cannot be ungiven, and no one can say what a mind that size will do with it at three in the morning.

So the work waits. Or worse — the key is handed over, and the owner waits instead, watching, because trust without proof is just hope with a deadline.

Authority is not a key

The mistake is old: confusing authority with possession. You do not give a builder the deed to your house; you give them a contract — this wall, this month, this budget. The deed stays in the drawer. The building happens anyway.

Cuna applies the same discipline to agents. You grant a mandate: read this repository, write that branch pattern, reach these hosts and no others. The mandate is the whole of the agent's authority. What it does not name, the agent cannot do.

Bound the authority.Leak nothing.

The mandate holds

Inside its session the agent works freely — its own files, its own tools, its own clock. What it cannot do is leave: the hosts it may reach are listed when the machine is made, and the list is the whole of what the network will carry.

The limit is the point. Anyone can show you a machine doing work; only a boundary shows you what the work could never touch. Your keys are part of it — the agent is handed a stub bound to one host, never the secret itself, so a key that never moved cannot leak from a run you did not watch.

The record remains

When the run ends, its record is already written: the session, every command it ran, every checkpoint it took, when it started and when you stopped it. The agent does not write it — the machine's own control plane does, as each thing happens, and an action that cannot be recorded does not report success. It does not depend on anyone's memory or goodwill.

This is what delegation was always supposed to feel like: you state the work, you set the limits, you leave. You come back to a result and a receipt. You do not wonder what the agent did. You read it.

The work ends.The proof remains.